http://www.secuobs.com Observatoire de la securite Internet fr webmaster@secuobs.com 2014-10-15 18:58:05 - Security et al : Vulnerability scanning can be a smart way to reduce risk on corporate networks But, there s a dark side to vulnerability scanning, too For instance, scan reports may show that your network is safe when threats still exist Scanners can also create a deluge of information, and leave you bewildered about where to begin Additionally, important assets may not be scanned because of a fear of affecting availability And you can waste a lot of time and effort correcting detected vulnerabilities that don t really matter So, what can you do To maximize the value of vulnerability scanning, you need to Manage executive expectations Coordinate with patch and configuration management Be aware of the context of your network, priorities and risk profile Automate all aspects of vulnerability management Ensure that new systems and network expansions aren t missed Explore this white paper to learn how to accomplish all this, and make your vulnerability scanning more meaningful to your business Click here to download the white paper http://www.secuobs.com/revue/news/540277.shtmlhttp://www.secuobs.com/revue/news/540277.shtml Secuobs.com : 2014-10-08 22:32:03 - Security et al - Many organizations are seeing surges in the amount of unstructured data in their environments, even as new data breaches come to light every week As a result, those organizations face increased audit and regulatory pressure regarding loose access controls over unstructured data that might contain sensitive information such as Social Security numbers, credit card data, health care information and proprietary data Download this white paper to discover How unstructured data can lead to increased costs and security vulnerabilities A seven-step process for establishing information owners for unstructured data A solution that helps automate the complex processes of governing and controlling unstructured data Click here to download the white paper http://www.secuobs.com/revue/news/539183.shtmlhttp://www.secuobs.com/revue/news/539183.shtml Secuobs.com : 2014-10-08 01:31:50 - Security et al - I just wrote a new whitepaper about SQL auditing Security analysts must have meaningful, relevant audit data from the mission critical applications such as SQL Server Database admins must have no disruptions nor degradation to the performance of the mission critical instances of SQL Server Beginning with SQL Server 2008,versions of Microsoft SQL Server offer a new, superior SQL audit capability custom-built to meet demands to continue reading over at LOGbindercom click here http://www.secuobs.com/revue/news/539022.shtmlhttp://www.secuobs.com/revue/news/539022.shtml Secuobs.com : 2014-07-07 16:29:42 - Security et al - SolarWinds Log and Event Manager provides connectors for common log sources that understand how to translate raw events from a specific log source into their equivalent normalized event type I love event normalization like SolarWind s LEM because it makes it so much easier to correlate events from multiple sources and to configure more generalized alerts, filters and reports For instance you can just ask for all logon failures without having to configure criteria for every example of logon failure logged by Windows, Linux, firewalls, etc That s the power of normalization SharePoint security is getting more and more attention because of the amount of sensitive unstructured data found there And with SharePoint s self-service features sensitive data just keeps growing as end-users create more and more content In this age of Snowden-like information grabs it s really important to detect unusual activity in SharePoint But getting SharePoint logs into any SIEM is not a simple matter SharePoint audit logs are trapped inside SharePoint itself there s no log file or event log that a SIEM can consume through normal means Happily SolarWinds partnered with LOGbinder and has done an awesome job integrating with LOGbinder SP LOGbinder SP is an easy-to-deploy middleware purpose built to pull raw audit events out of SharePoint, translate all the cryptic codes and ID numbers and then export understandable audit logs which can be easily consumed by SIEMs through normal log collection means Not only did SolarWinds create the necessary connector to consume SharePoint audit events from LOGbinder But as a SIEM Synergy Partner, SolarWinds took my recommended reports and alert specs for SharePoint and implemented them in a set of Filters, Rules and Reports for Log and Event Manager All you have to do is point Log and Event Manager at LOGbinder SP s event log and you ve got real-time monitoring and historical analysis of the Share Point security activity Check out the screen print below showing SharePoint permission changes in Log and Event Manager IMAGE And below is an example report showing document deletions in a SharePoint Document Library IMAGE Here s a list of some of the things in SharePoint you can automatically monitor or detect with Log and Event Manager Access control changes on documents and lists Administrator changes Group membership changes Audit policy changes Audit log tampering Import Export of Data Item deletions Who s been viewing sensitive documents SolarWinds did a great job implementing our monitoring and reporting recommendations, but thanks to Log and Event Manager s LEM event normalization you can also correlate SharePoint audit events with similar audit activity from other log sources For instance you can search on a given user and see their activity as reported by SharePoint, Active Directory and any other log sources managed by LEM To learn more about LEM s normalization and other features check out this blog http wwwultimatewindowssecuritycom blog defaultaspx p a27fadf5-b1d2-4216-a444-f60d496ab99c or download Log and Event Manager here http wwwsolarwindscom register registrationbaspx program 1520 c 70150000000PExs You can download a trial of LOGbinder SP from http wwwlogbindercom Form LBSPDownload and the integration pack for LEM and LOGbinder SP here http thwacksolarwindscom docs DOC-167091 Try them out http://www.secuobs.com/revue/news/523924.shtmlhttp://www.secuobs.com/revue/news/523924.shtml Secuobs.com : 2014-05-05 23:51:02 - Security et al - Unstructured data access governance is a big compliance concern Unstructured data is difficult to secure because there s so much of it, it s growing so fast and it is user created so it doesn t automatically get categorized and controlled like structured data in databases Moreover unstructured data is usually a treasure trove of sensitive and confidential information in a format that bad guys can consume and understand without reverse engineering the relationship of tables in a relational database Most of this unstructured data is still to be found on file shares throughout the network and file system permissions are the main control over this information Therefore knowing when permissions change n unstructured is critical to governance and control File permissions should normally be fairly static but end-users are by default the owner of files and subfolders they create and can therefore change permissions on those files And of course administrators can change permissions on any object Either way you need to know when this happens and I m going to show you how with the Windows Security Log First we need to enable the File System audit subcategory You ll find this policy in any group policy object under Computer Configuration Windows Settings Security Settings Advanced Audit Policy Configuration System Audit Policies Object Access Enable File System for success By the way, make sure you also enable Computer Configuration Windows Settings Security Settings Local Policies Security Options Audit Force audit policy subcategory settings to override audit policy category settings to make sure your audit policy takes effect Now you need to enable object level auditing on the root folders containing your unstructured data For instance if you have a shared folder called c files, go to that folder in Windows Explorer, open the security tab of the folders properties, click Advanced and select the Auditing tab Now add an entry for Everyone that enables successful use of the Change permissions as shown below IMAGE At this point Windows will begin generating 2 events each time you change permissions on this folder or any of its subfolders or files One event is the standard event ID 4663, An attempt was made to access an object , which is logged for any kind of audited file access like read, write, delete, etc That event will show WRITE_DAC under the Access Request Information but it doesn t tell you what the actual permission change was So instead, use event ID 4670, Permissions on an object were changed , which provides the before and after permissions of the object under Permissions Change as shown in the example below IMAGE I know what you are thinking What does D AI A ID FA AU A ID FA WD A ID FA BA A ID FA SY A ID 0x1200a9 BU mean That my gentle reader is the original access control list of asdftxt but in the very cryptic Security Descriptor Definition Language SDDL SDDL definitely isn t something you want to manually parse and translate on a regular basis But you can when necessary Look for the D which is close to the beginning of the string or even the very beginning in this case D means Discretionary Access Control List DACL which are the actual permissions on the object as opposed to other things that show up in a security descriptor like owner, primary group and the audit policy aka SACL Until you hit another letter-colon combination like S you are looking at the object s permissions An ACL is made up of Access Control Entries which correspond to each item in the list you see in the Permissions tab of an object s properties dialog But in SDDL before listing the ACEs comprising the ACL you will see any flags that affect the entire ACL as a whole In the example above you see AI as the first element after D AI stands for SDDL_AUTO_INHERITED which means permissions on parent objects are allowed to propagate down to this object Now come the ACEs In SDDL, each ACE is surrounded by parenthesis and the fields within it delimited by semicolons The first ACE in the event above is A ID FA AU The first field tells you what type of ACE it is either A for allow or D for deny The next field lists any ACE flags that specify whether this ACE is an inherited ACE prorogated down from a parent object and if and how this ACE should propagate down to child objects The only flag in this ACE is ID which means the ACE is in fact inherited The next field lists the permissions this ACE allows or denies In this example FA stands for all file access rights The next 2 fields, Object Type and Inherited Object Type, are always blank on file system permissions hence the 3 semicolons in a row they are only used places like Active Directory where there are different types of objects user, group, computer, etc that you can define permissions for Finally, the last field is Trustee and identifies the user, group or special principal begin allowed or denied access Here you will either see the SID of the user or group if the ACE applies to a so-called well-known SID you ll the corresponding acronym In this example AU stands for Authenticated Users Event ID 4670 does a great job of alerting you when permissions change on an object and telling you which object was affected and who did it To go further and understand what permissions where actually changed you have to dive into SDDL I recommend Ned Pyle s 2-part TechNet blog, The Security Descriptor Definition Language of Love for more information on SDDL This article first appeared as a newsletter on the EventTracker website http://www.secuobs.com/revue/news/511962.shtmlhttp://www.secuobs.com/revue/news/511962.shtml Secuobs.com : 2014-03-13 18:58:42 - Security et al - I found some pretty cool stuff at RSA Some new technologies that I ve never thought of before and others that are just as fun as they are valuable More Fun with Hard Drive Destruction Fun and an effective solution to a vexing problem old hard drives full of sensitive information Garner Products booth showed off some epically cool machines to take care of that problem IMAGE Using a magnet rivalling those in MRIs, the HD-3WXL, can degauss one hard drive every 10 seconds But even cooler is the PD-5 which physically breaks drives in half You have to watch this video http wwwgarner-productscom PD-5htm How fun is that Plus the drive can still be disassembled and recycled as opposed to shredders which create a toxic waste disposal problem You Can t Trace My Packets My Neat-O-Meter redlined at Dispersive Technologies booth when I grasped what they do, which is a new way to securely send information over the Internet Quantum Encryption you ask Ha That is so passé The VSV products use a spread spectrum approach to breaking data up and sending it over many, unpredictable paths over the Internet as a way to defeat man-in-the-middle attacks Any given observation point only sees a fraction of the data being transmitted There s not many entities that could even begin to try to observe every path see my Elephants and Irony at RSA post With VSV products both endpoints securely negotiate and dynamically adjust their use of multiple deflectors on the Internet to scramble their data and send different bits of it along completely different paths Sounds slow Rob Smith no relation to yours truly explained that the endpoints automatically and dynamically stop using deflectors on slow paths and sometimes produce greater throughput than traditional shortest path network No More Excuses for Security Unawareness Finally, we all know that at the end of the day, with every security technology deployed, your weakest link remains the human element And we all tend to pay lip service to the need for security awareness training But what do we do about beyond putting up some posters and having new hires sign some documents when they first come in And how many managers will approve and pay for in-person training sessions which users quickly forget about How do you increase security awareness and sustain it over the long haul That s what I liked about what I saw at Visible Statement s booth Their software integrates with your endpoint with just the right amount of animated security awareness training and supports many different languages http://www.secuobs.com/revue/news/502812.shtmlhttp://www.secuobs.com/revue/news/502812.shtml Secuobs.com : 2014-03-03 21:02:43 - Security et al - I was amazed when I saw the Beijing Zhongguancun Overseas Science Park Elephant 1 in the North expo hall Beijing Zhongguancun Overseas Science Park Some folks come out and say it and some use euphemisms but when people talk about APT actors, that boogeyman is commonly regarded as China At least until Snowden, which brings us to NSA's large booth in the South expo Hall - Elephant 2 IMAGE Back to Elephant 1 for a second Who knew there were security software companies in China - was my question But attendees are asking Who would install a highly trusted piece of security software written in China Ironic Being an honest IT security firm in China can't be fun One gentlemen we breakfasted with confirmed it's an uphill battle If that's ironic, then a German colleague's comment is irony2 Who really wants to buy IT security software from a US vendor after all the Snowden revelations Wow, Chinese and American security companies in the same boat I begin to see the logic behind Germany sponsoring a large pavilion in the north hall spotlighting their country's security firms The irony continues when you think about the Chinese-made chips and US-written software running on security appliances on display I wonder where all of this will lead or if it will eventually blow over http://www.secuobs.com/revue/news/500879.shtmlhttp://www.secuobs.com/revue/news/500879.shtml Secuobs.com : 2014-02-26 21:33:04 - Security et al - Dominant impression If you can t say it, you don t know it So many booths so little idea of what they do I know they don t do everything None of us do Not even the titans of the infosec industry So one of us either yours truly or the infosec marketing collective mind is belaboring under a fundamental misconception And it would be so nice if one of us were disabused of it This sounds ludicrous as I write it but are companies consciously trying to hide the space in which they play I can see that there are some disadvantages to be pigeon-holed or typecast Those are negative terms But isn t targeted and qualified the other, positive, side of that coin Here s a few exhibitors where you can walk up, understand what they offer at a glance and get some real information from someone that understand what their company does and offers These certainly aren t the only companies with great technologies but these make it easy for you find them LogRhythm - Powerful SIEM with a massive investment in knowledge engineering and log normalization Lumension - Awesome endpoint security Cut every head of the endpoint security medusa with on agent and a single pane of glass STEALTHbits - Powerful yet affordable technology for data access governance ManageEngine - Affordable, easy-to-use SIEM and other cool solutions like privileged password management SolarWinds - Affordable, easy-to-use SIEM with normalization Dell Software - Staggering array of IAM and GRC technology http://www.secuobs.com/revue/news/500049.shtmlhttp://www.secuobs.com/revue/news/500049.shtml Secuobs.com : 2014-01-02 22:04:16 - Security et al - This article was first published in EventTracker s EventSource Newsletter http wwweventtrackercom newsletters auditing-file-shares-windows-security-log open Over the years, security admins have repeatedly ask me how to audit file shares in Windows Until Windows Server 2008, there were no specific events for file shares About the best we could do was enable auditing of the registry key where shares are defined But in Windows Server 2008 and later there are 2 new subcategories for share related events File Share Detailed File Share File Share Events The good news is that this subcategory allows you to track the creation, modification and deletion of shared folders see table below You have a different event ID for each of those 3 operations The events indicate who made the change in the Subject fields and provides the name of the share users see when browsing the network and the patch to the file system folder made available by the share See the example of event ID 5142 below A network share object was added Subject Security ID W8R2 wsmith Account Name wsmith Account Domain W8R2 Logon ID 0x475b7 Share Information Share Name AcmeAccounting Share Path C AcmeAccounting The bad news is the subcategory also produces event ID 5140 each and every time a user connects to a share The data logged, which includes who accessed it and their client IP address, is nice but the event is logged much too frequently Since Windows doesn t keep network logon sessions active if no files are held open you will tend to see this event a lot if you enable File Share audit subcategory There is no way to configure Windows to produce just the share change events and not this access event as well Of course that s the point of a log management solution like EventTracker which can be configured to filter out the noise 5140 A network share object was accessed 5142 A network share object was added 5143 A network share object was modified 5144 A network share object was deleted Detailed File Share Events Event ID 5140, as discussed above, is intended to document each connection to a network share and as such it does not log the names of the files accessed through that share connection The Detailed File Share audit subcategory provides this lower level of information with just one event ID 5145 which is shown below A network share object was checked to see whether client can be granted desired access Subject Security ID SYSTEM Account Name WIN-KOSWZXC03L0 Account Domain W8R2 Logon ID 0x86d584 Network Information Object Type File Source Address fe80 507a 5bf7 2a72 c046 Source Port 55490 Share Information Share Name SYSVOL Share Path C Windows SYSVOL sysvol Relative Target Name w8r2com Policies 6AC1786C-016F-11D2-945F-00C04fB984F9 Machine Microsoft Windows NT Audit auditcsv Access Request Information Access Mask 0x120089 Accesses READ_CONTROL SYNCHRONIZE ReadData or ListDirectory ReadEA ReadAttributes Access Check Results READ_CONTROL Granted by Ownership SYNCHRONIZE Granted by D A 0x1200a9 WD ReadData or ListDirectory Granted by D A 0x1200a9 WD ReadEA Granted by D A 0x1200a9 WD ReadAttributes Granted by D A 0x1200a9 WD This event tells identifies the user Subject fields , the user s IP address Network Information , the share itself and the actual file accessed via the share Share Information and then provides the permissions requested and the results of the access request As you can see this event actually logs the access attempt and therefore you will see failure versions of the event as well as success events But be careful about enabling this audit subcategory because you will get an event for each and every file accessed through network shares every time the application opens the file That can be much more frequent than you d imagine for some applications like Microsoft Office Conversely, remember that this category won t catch access attempts on the same files if a locally executing application accesses the file via the local patch eg c docs filetxt instead of via a patch Instead you might want to consider enabling auditing on individual folders containing critical files and using the File System subcategory This method allows you to be much more selective about who, which files and what types of access are audited For most organizations I suggest enabling the File Share subcategory if it s important to you to know when new folders are shared But you will probably want to filter out all those occurrences of 5140 Then if you have file level audit needs, turn on the File Access subcategory, identify the exact folders containing the relevant files and then enable auditing on those folders for the specific operations eg Read, Write, Delete necessary to meet your audit requirements Don t enable the Detailed File Share audit subcategory unless you really want events for every access to every file via network shares http://www.secuobs.com/revue/news/489440.shtmlhttp://www.secuobs.com/revue/news/489440.shtml Secuobs.com : 2013-11-19 20:20:02 - Security et al - There are 5 different ways you can logon in Windows We call them logon types The Windows Security Log lists the logon type in event ID 4624 whenever you logon Logon type is what allows you to determine if the user logged on at the actual console, via remote desktop, via a network share or if the logon is connected to a service or scheduled task starting up The logon types are Type Description Allow right Deny right 2 Interactive logon at keyboard and screen of system SeInteractiveLogonRight Allow logon locally SeDenyInteractiveLogonRight Deny logon locally 3 Network ie connection to shared folder on this computer from elsewhere on network SeNetworkLogonRight Access this computer from the network SeDenyNetworkLogonRight Deny access to this computer from the network 4 Batch ie scheduled task SeBatchLogonRight Log on as a batch job SeDenyBatchLogonRight Deny logon as a batch job 5 Service Service startup SeServiceLogonRight Log on as a service SeDenyServiceLogonRight Deny logon as a service 10 RemoteInteractive Terminal Services, Remote Desktop or Remote Assistance SeRemoteInteractiveLogonRight Allow logon through Terminal Services SeDenyRemoteInteractiveLogonRight Deny logon through Terminal Services There are a few other logon types recorded by event ID 4624 for special cases like unlocking a locked session but these aren t real logon session types Knowing the session type in logon events is great but you can also control users ability to logon in each of these 5 ways A user account s ability to logon is governed by 5 user rights found in group policy under Computer Configuration Windows Settings Security Setting User Right Assignments There is an allow and deny right for each logon type In order to logon in a given way you must have the corresponding allow right But the deny right for that same logon type takes precedence For instance, in order to logon at the local keyboard and screen of a computer you must have the Allow logon locally right But if the Deny logon locally right is also assigned to you or any group you belong to, you won t be able to logon The table below lists each logon type and it s corresponding allow and deny rights Logon rights are very powerful They are your first level of control determining whether a user can access a given system at all After logging in of course their abilities are limited by object level permissions Since logon rights are so powerful it s important to know if they are suddenly granted or revoked and you can do this with Windows Security Log events 4717 and 4718 which are logged whenever a given right is granted or revoked respectively To get these events you need to enable the Audit Authentication Policy Change audit subcategory Events 4717 and 4718 identify the logon right involved in the Access Granted Access Removed field using a system name for the right as shown in corresponding column in the table above The events also specify the user or group who was granted or revoked from having the right in the Account Modified field Here s an example of event ID 4717 where we granted the Access this computer from the network to the local Users group System security access was granted to an account Subject Security ID SYSTEM Account Name WIN-R9H529RIO4Y Account Domain WORKGROUP Logon ID 0x3e7 Account Modified Account Name BUILTIN Users Access Granted Access Right SeNetworkLogonRight There s just one problem The events do not tell you who which administrator granted or revoked the right The reason is that user rights are controlled via group policy objects Administrators do not directly assign or revoke user rights on individual systems even if you modify the Local Security Settings of a computer you are really just editing the local group policy object When Windows detects a change in group policy it applies the changes to the local configuration and that s when 4717 and 4718 are logged At that point the user making the change directly is just the local operating system itself and that s why you see SYSTEM listed as the Subject in the event above So how can you figure out who a granted or removed the right You need to be tracking group policy object changes is a topic I ll cover in the future http://www.secuobs.com/revue/news/481954.shtmlhttp://www.secuobs.com/revue/news/481954.shtml Secuobs.com : 2013-10-15 21:07:25 - Security et al - This article was first published in EventTracker s EventSource Newsletter http wwweventtrackercom newsletters using-dynamic-audit-policy-to-detect-unauthorized-file-access One thing I always wished you could do in Windows auditing was mandate that access to an object be audited if the user was NOT a member of a specified group Why Well sometimes you have data that you know a given group of people will be accessing and for that activity you have no need of an audit trail Let s just say you know that members of the Engineering group will be accessing your Transmogrifier project folder and you do NOT need an audit trail for when they do But this is very sensitive data and you DO need to know if anyone else looks at Transmogrifier In the old days there was no way to configure Windows audit policy with that kind of negative Boolean or exclusive criteria With Windows 2008 7 and before you could only enable auditing based on if someone was in a group not the opposite Windows Server 2012 gives you a new way to control audit policy on files You can create a dynamic policies based on attributes of the file and user By the way, you get the same new dynamic capabilities for permissions, too Here s a screen shot of audit policy for a file in Windows 7 Now compare that to Windows Server 2012 The same audit policy is defined but look at the Add a condition section This allows you to add further criteria that must be met before the audit policy takes effect Each time you click Add a condition Windows adds another criteria row where you can add Boolean expressions related to the User, the Resource file being accessed or the Device computer where the file is accessed In the screen shot below I ve added a policy which accomplishes what we described at the beginning of the article So we start out by saying that Everyone is audited when they successfully read data in this file But then we limit that to users who do not belong to the Engineering group Pretty cool, but we are only scratching the surface You can add more conditions and you can join them by Boolean operators OR and AND You can even group expressions the way you would with parenthesis in programming code The example below shows all of these features so that the audit policy is effective if the user is either a member of certain group or department is Accounting and the file has been classified as relevant to GLBA or HIPAA compliance You ll also notice that you can base auditing and access decision on much more that the user s identity and group membership In the example above we are also referencing the department specified on the Organization tab of the user s account in Active Directory But with dynamic access control we can choose any other attribute on AD user accounts by going to Dynamic Access Control in the Active Directory Administrative Center and selecting Claim Types as shown here You can create claim types for about any attribute of computer and user objects After creating a new claim type for a given attribute, it s available in access control lists and audit policies of files and folders throughout the domain But dynamic access control and audit policy doesn t stop with sophisticated Boolean logic and leveraging user and computer attributes from AD You can now classify resources folders and files according to any number of properties you d like Below is a list of the default Resource Properties that come out of the box Before you can begin using a given Resource Property in a dynamic access control list or audit policy you need to enable it and then add it to a Resource Property List which is shown here After that you are almost ready to define dynamic permissions and audit policies The last setup step is to identity file servers where you want to use classify files and folders with Resource Properties On those file servers you need to add the File Server Resource Manager subrole After that when you open the properties of a file or folder you ll find a new tab called Classification Above you ll notice that I ve classified this folder as being related to the Transmogrifier project Be aware that you can define dynamic access control and audit policies without referencing Resource Properties or adding the File Server Resource Manager subrole you ll just be limited to Claim Types and the enhanced Boolean logic already discussed The only change to the file system access events Windows sends to the Security Log is the addition of a new Resource Attributes to event ID 4663 which I ve highlighted below This field is potentially useful in SIEM solutions because it embeds in the audit trail a record of how the file was classified when it was accessed This would allow us to classify important folders all over our network as ACME-CONFIDENTIAL and then include that string in alerts and correlation rules in a SIEM like EventTracker to alert or escalate on events where the information being accessed has been classified as such The other big change to auditing and access control in Windows Server 2012 is Central Access Policies which allows you to define a single access control list or audit policy in AD and apply it to any set of computers That policy is now evaluated in addition to the local security descriptor on each object While Microsoft and press are concentrating on the access control aspect of these new dynamic and central security features, I think the greatest immediate value may come from the audit policy side that we ve just explored If you d like to learn more about dynamic and central access control and audit policy check out the deep dive session I did with AN Ananth of EventTracker File Access Auditing in Windows Server 2012 http://www.secuobs.com/revue/news/474806.shtmlhttp://www.secuobs.com/revue/news/474806.shtml Secuobs.com : 2013-10-14 23:12:51 - Security et al - I have a new technical brief titled Who, What, When, Where and Why Tracking the 5 W's of Change in Active Directory, SharePoint, SQL Server, Exchange and VMware Your organization relies on you to prevent and detect tampering, unauthorized access or human error to your key enterprise technologies, including Active Directory, SharePoint, SQL Server, Exchange and VMware In this brief, Windows security expert Randy Franklin Smith explores the 5 W's of auditing critical changes to your core technologies by discussing The types of activities that you can audit How to enable auditing and where to find audit data The hidden gaps, caveats and weaknesses of built-in auditing tools How ChangeAuditor from Dell Software fills the gaps in auditing You ll come away with a better understanding of the limitations and capabilities of native auditing tools and why a third-party solution might be the best approach to protect your systems, data and your company s productivity and bottom line Click here to read more http://www.secuobs.com/revue/news/474569.shtmlhttp://www.secuobs.com/revue/news/474569.shtml Secuobs.com : 2013-09-18 00:31:26 - Security et al - This article was first published in EventTracker s EventSource Newsletter http wwweventtrackercom newsletters following-a-users-logon-tracks-throughout-the-windows-domain In this article, I ll show you the security events that get logged when a user logs on to their workstation with a domain account and proceeds to run local applications and access resources on servers in the domain You can see examples of all the events described in this article at the Security Log Encyclopedia When a user logs on at a workstation with their domain account the workstation contacts domain controller via Kerberos and requests a ticket granting ticket TGT If the user fails authentication, the domain controllers logs event ID 4771 or an audit failure instance 4768 The result code in either event specifies the reason for why authentication failed Bad passwords and time synchronization problems trigger 4771 and other authentication failures such as account expiration trigger a 4768 failure These result codes are based on the Kerberos RFC 1510 and in some cases one Kerberos failure reason corresponds to several possible Windows logon failure reasons In these cases the only way to know the exact reason for the failure is to check logon event failure reason on the computer where the user is trying to logon from If the user s credentials authentication checks out OK, the domain controller creates a TGT, sends that ticket back to the workstation and logs event ID 4768 Event ID shows the user who authenticated and the IP address of the client the workstation in this case Note that there is no logon session identifier though This is because the domain controller handles authentication not logon sessions Authentication events are just events in time sessions have a beginning and an end In Windows, each member computer workstation and servers handles its own logon sessions When the domain controller fails the authentication request, the local workstation will log 4625 in its local security log noting the user s domain, logon name and the failure reason There is a different failure reason for every possible reason a Windows logon can failure in contrast with the more general result codes generated by the Kerberos domain controller events described above If authentication succeeds and the domain controller sends back a TGT, the workstation creates a logon session and logs event ID 4624 to the local security log This event identifies the user who just logged on, the logon type and the logon ID The logon type is a number that specifies whether the logon session is interactive, remote desktop, network based ie incoming connection to shared folder , a batch job eg Scheduled Task or a service logon triggered by a service logging on The logon ID is a hexadecimal number identifying that particular logon session All subsequent events associated with activity during that logon session will bear the same logon ID making it relatively easy to correlate all the activity of a user while she is logged on When the user finally logs off Windows will record a 4634 followed by a 4647 Event ID 4634 indicates the user initiated the logoff sequence which may get canceled Once the logon session fully terminates you get logon 4647 If the system is shut down all logon session get terminated and since the user didn t initiate the logoff, no event ID 4634 is logged While a user is logged on they typically access one or more servers on the network Their workstation automatically re-uses the domain credentials they entered at logon to connect to other servers When a server receives a logon request such when a user tries to access a shared folder on a file server the user s workstation requests a service ticket from the domain controller that authenticates the user to that server The domain controller logs 4769 which is useful because it tells you that user X accessed server Y the computer name of the server accessed is found in the Service Name field of 4769 When the workstation presents the service ticket to the file server, the server creates a logon session and records event ID 4624 just like the workstation did earlier but this time logon type is 3 network logon However as soon as the user closes all files opened during this network logon session, the server automatically ends the logon session and records 4647 Therefore network logon sessions typically last for less than a second while a file is saved unless the user s application keeps a file open on the server for extended periods of time This results in the constant stream of logon logoff events that you typically observe on file servers and means that logon logoff events on servers with logon type 3 are not very useful It is probably better to focus on access events to sensitive files using object access auditing You will see additional logon logoff events on servers and authentication events associated with other types of user activity such as Remote desktop connections Service startups Scheduled tasks Application logons especially IIS based applications like SharePoint, Outlook Web Access and ActiveSync mobile device clients These events will generate logon logoff events on the application servers involved and Kerberos events on domain controllers You may also see NTLM authentication events on domain controllers from clients and applications that use NTLM instead of Kerberos NTLM events fall under the Credential Validation subcategory of the Account Logon audit category in Windows There is only event ID logged for both successful and failed NTLM authentication events As you can see, a user leaves tracks on each system they access and the combined security logs of your domain controllers alone provide a complete list of every time a domain account is used and which workstations and servers were accessed Understanding Kerberos and NTLM and how Windows separates the concepts of logon sessions from authentication really helps you interpret these events and grasp why different events are logged on each system http://www.secuobs.com/revue/news/469247.shtmlhttp://www.secuobs.com/revue/news/469247.shtml Secuobs.com : 2013-08-22 20:37:16 - Security et al - Are you registered for HP Protect 2013 Can you come I hope to see you there at my LOGbinder booth and at my breakout session 1488 Setting traps for malicious outsiders and APTs on your network HP Protect is next month September 16-19 in Washington, DC It s a great event for infosec professionals tasked with monitoring networks and detecting intrusions Here s more information on my session Think outside the box with well-known security log expert Randy Franklin Smith as he argues that we ve been going about catching bad guys the wrong way Trying to detect malicious activity by defining what makes it an anomaly is difficult So turn the concept on its head and make malicious activity stand out as intentional and not a one-time event In this session, instead of looking for hints of malicious activity and weeding through false positives, Randy will show you how to set up traps throughout your network and applications that automatically distinguish between normal insider activity and malicious outsiders or APTs even if the attacker is running under the credentials of a legitimate user The principles are applicable to any technology, but Randy will specifically demonstrate laying traps in Windows, SQL Server, and SharePoint You will also learn how to deal with the end-user awareness and admin pushback challenges that may arise when implementing traps What is HP Protect It is HP s annual security user conference It began as an ArcSight conference and, after HP acquired ArcSight, evolved into a comprehensive, pan-HP security conference that delivers technical content, product roadmaps, demos, instruction, and services to users of HP, HP ArcSight, HP Atalla, HP Fortify, and HP TippingPoint software Why attend Meet Randy Franklin Smith Ha Seriously, why attend How about 100 hours of content 16 hours with HP experts 2 hours of keynotes 8 hours of networking Nearly 150 technical sessions 100 hours of content 8 hours of networking with 1,000 security professionals 16 hours of one-on-one access to HP security experts 5 post-conference training courses Earn up to 15 CPE credits to keep your CISSP credentials current Learn about updates to the entire HP enterprise security portfolio Explore new technology, emerging trends, and ways of extending your investments with HP and your peers Any other reasons Conference party Rock out to Hey, Soul Sister Are you a fan of the band Train Enjoy their Grammy-winning hits at a private concert celebrating HP Protect Lead singer Pat Monahan, and guitarist Jimmy Stafford accompanied by a guest drummer will perform a lineup of Train s pop-rock music for your entertainment What about the content Here s the full session catalog I hope to see you there IMAGE http://www.secuobs.com/revue/news/464469.shtmlhttp://www.secuobs.com/revue/news/464469.shtml Secuobs.com : 2013-07-26 22:11:59 - Security et al - A fellow Microsoft Most Valuable Professional MVP and our friends over at MSExchangeGuru recently reached out to me regarding an event being held by Virtual Tech Conference VTC VTC is a MVP community with the goal of keeping us all up-to speed on the latest Microsoft technologies You re invited to attend the conference and listen to a very interesting lineup of speakers and topics like Windows 8, SharePoint 2013, and deep dives in to Exchange 2013 You can sign up for the August 1, 2013 sessions by clicking here http://www.secuobs.com/revue/news/459427.shtmlhttp://www.secuobs.com/revue/news/459427.shtml Secuobs.com : 2013-06-30 05:10:11 - Security et al - Big Data Security Analytics BDSA is the subject of exuberant predictions However, a Gartner analyst points out that no available BDSA solutions come close to these forecasts Nevertheless, the principles of Big Data are the key to advanced security intelligence This white paper discusses the key tenets of Big Data and points out The hidden skill requirement of BDSA data scientists The real-time requirement for security intelligence, often misunderstood in relation to Big Data The risk of data silos persisting in Big Data repositories Investing in a Big Data cluster that runs search and a schema-less database is only the beginning of building a BDSA practice Download this document today to learn about Big Data Security Analytics and where BDSA fits in with SIEM Does BDSA replace SIEM Click here to download the white paper and find out http://www.secuobs.com/revue/news/454588.shtmlhttp://www.secuobs.com/revue/news/454588.shtml Secuobs.com : 2013-06-12 19:15:04 - Security et al - Just in case you missed today's webinar you can still get my whitepaper that the webinar was based off of Click here to download my whitepaper APT Confidential 14 Lessons Learned from Real Attacks Our webinar and whitepaper sponsor, Bit9, gave me a unique opportunity to interview security analysts at not only Bit9 but also some of their customers This whitepaper explains the lessons learned from real attacks http://www.secuobs.com/revue/news/451018.shtmlhttp://www.secuobs.com/revue/news/451018.shtml Secuobs.com : 2013-05-13 19:38:21 - Security et al - This article was first published in EventTracker s EventSource Newsletter http wwweventtrackercom newsletters how-to-use-process-tracking-events-in-the-windows-security-log I think one of the most underutilized features of Windows Auditing and the Security Log are Process Tracking events In Windows 2003 XP you get these events by simply enabling the Process Tracking audit policy In Windows 7 2008 you need to enable the Audit Process Creation and, optionally, the Audit Process Termination subcategories which you ll find under Advanced Audit Policy Configuration in group policy objects These events are incredibly valuable because they give a comprehensive audit trail of every time any executable on the system is started as a process You can even determine how long the process ran by linking the process creation event to the process termination event using the Process ID found in both events Examples of both events are shown below Process Start WinXP 2003 592 A new process has been created Subject Security ID WIN-R9H529RIO4Y Administrator Account Name Administrator Account Domain WIN-R9H529RIO4Y Logon ID 0x1fd23 Process Information New Process ID 0xed0 New Process Name C Windows System32 notepadexe Token Elevation Type TokenElevationTypeDefault 1 Creator Process ID 0x8c0 Win7 2008 4688 Process End WinXP 2003 593 A process has exited Subject Security ID WIN-R9H529RIO4Y Administrator Account Name Administrator Account Domain WIN-R9H529RIO4Y Logon ID 0x1fd23 Process Information Process ID 0xed0 Process Name C Windows System32 notepadexe Exit Status 0x0 Win7 2008 4689 Trying to determine what a user did after logging on to Windows can be difficult to piece together These events are valuable on workstations because they are often the most granular trail of activity left by end-users You can tell for instance that Bob opened Outlook, a few minutes later opened Word, opened Excel and then closed Word As you can see the process start event tells you the name of the program and when it started It also tells you who ran the program and the ID of their logon session with which you can correlate backwards to the logon event and thus further determine what kind of logon session in which the program was run and where the user if remote was on the network using the IP address and or workstation name provided in the logon event Process start events also document the process that started them using Creator Process ID which can be correlated backwards to the process start event for the parent process This can be invaluable when you are trying to figure out how a suspect process was started If the Creator Process ID points to Explorerexe, after tracking down the process start event, then it s likely that the user simply started the process from the start menu These same events, when logged on servers, also provide a degree of auditing over privileged users but be aware that many Windows administrative functions will all show up as process starts for mmcexe since all Microsoft Management Console apps run within mmcexe But beyond privileged and end-user monitoring, process tracking events help you track possible change control issues and to trap advanced persistent threats When new software is executed for the first time on a given system it s important to know that, since it implies a significant change to the system or it could alert you to a new unauthorized and even malicious program running for the first time The key to this seeing this kind of activity is to compare the executable name in a recent event 592 4688 to executable names in a whitelist - and thereby recognizing new executables Of course this method isn t full proof because someone could replace an existing executable on your whitelist with a new program but with the same name and path as the old Such a change would fly under the radar with process tracking But my experience with unauthorized changes that bypass change control and APTs indicates that while certainly possible, the methods described here-in will catch their share of offenders and attackers Of course to do this kind of correlation you need to enable process tracking on applicable systems all systems if possible, including workstations and then you need a SIEM solution that can compare the executable name in the current event to a whitelist of executables How you build that whitelist is important because it determines if your criteria for a new executable is unique to that system, or if it is based on a golden system, or your entire environment Of course the more unique your whitelist is to each system or type of system the better You can build the whitelist by either scanning for all the EXE files on a given system or by analyzing the 592 4688 events over some period of time I prefer the latter because there are many EXE files on Windows computers that are never actually executed and I d like to know the first time any new EXE is run whether it came with Windows and installed applications out of the box or whether it is a new EXE recently dropped onto the system On the other hand if you only want to detect when EXEs run which were not present on system at the time the whitelist was created, then a list built from simply running dir exe s will suffice If you opt to analyze a period of system activity make sure that the period is long enough cover the full usage profile and business process profile for that system usually a month will do it Take some time to experiment with Process Tracking events and I think you ll find that they are valuable for knowing what running on your system and who s running it http://www.secuobs.com/revue/news/445119.shtmlhttp://www.secuobs.com/revue/news/445119.shtml Secuobs.com : 2013-02-18 21:11:52 - Security et al - I m excited to announce the release of LOGbinder EX for Exchange Server which bridges the gap between Exchange and your SIEM With today s ever-growing compliance burden and threat-scape, obtaining visibility into the dominant messaging platform is crucial to security and business risk management for most organizations Thankfully, Exchange Server provides an audit trail of non-owner access to mailboxes as well as privileged activity by Exchange administrators With mailbox auditing, you can detect Users viewing an executive s confidential email Impersonated, fraudulent emails Administrators exporting copies of entire mailboxes Deletion of emails to cover up evidence With administrator auditing, you can detect Exports of mailboxes Copies of entire mailbox databases Security configuration changes to Exchange Access control changes to groups, roles, and permissions Modifications to Exchange policies involving retention, mobile device policy, information rights management, federation, and more But, like many application audit logs today, the information is trapped within the application and specific to Exchange, audit logs are actually maintained in mailboxes Applications benefit from internal audit capability but ultimately audit logs should be copied as frequently as possible to a separate, isolated log management system LOGbinder EX efficiently process native Exchange audit data and translates cryptic codes, yielding an easy-to-understand Exchange audit log to the Windows event log or syslog where any log management SIEM solution can take over with collection, alerting, reporting, and secure archival LOGbinder EX performs these functions on both the administrator audit log and the mailbox audit log LOGbinder EX can be installed on most any server in your domain there's no need to install it on any of your Exchange servers thus preventing impact on production mail flow Exchange audit logs need to be monitored and they belong in your SIEM Use LOGbinder EX to bridge the gap Please download LOGbinder today or contact us for a demo I ve also got a whitepaper that explains Exchange Server s 3 Audit Logs and how LOGbinder and your SIEM fit in Click here to read the whitepaper http://www.secuobs.com/revue/news/428409.shtmlhttp://www.secuobs.com/revue/news/428409.shtml Secuobs.com : 2013-01-25 17:39:08 - Security et al - It s been a huge project to record, edit, embellish and enhance but we are finally done My 3-day Security Log Secrets course on the Windows Security Log is now available in my unique On-Demand, Interactive format We call it on-demand because you can take the course anytime We call it interactive to emphasize this is no passive, couch-potato DVD viewing experience My On-Demand Interactive courses provide highly interactive training designed to closely duplicate the live, instructor-led learning experience Security Log Secrets On-Demand Interactive SLS-OI is like in-person training you can take anytime, anywhere Get the same CPE credit Get the same courseware Watch me teach the same material Perform the same hands-on exercises If you get stuck, watch me perform the exercise Stay engaged with frequent flash quizzes Got a question Ask me via the Q A forum Security Log Secrets is fun and fascinating and you can get the full details of the Security Log Secrets course here, and my On Demand Interactive training platform here, but what I want to focus the rest of this email on is how I m going to help as many of you as possible get this training Which of the following fits your circumstance 1 For my most loyal webinar attendees, those of you that have attended 50 or more live webinars, you get SLS-OI free, and that s true going forward from this point You can get a transcript of your attendance any time Congrats to Christopher, J , Paul, Peter, Hugo, Steve , Jeff and others Here s what to do Email a copy of your transcript to Bridget at info ultimateWindowsSecuritycom and enroll using Purchase Order as the method We will take care of the rest The same goes for the rest of you when you reach 50 live attended webinars 2 For anyone who has purchased my Security Log Resource Kit in the past, we re giving you 50pourcents off Email your coupon code request to Bridget at info ultimateWindowsSecuritycom and be sure to include the email address used when you purchased the kit so that we can verify We ll respond with a coupon code 3 Are you out of work in this tough economy I realize you need to keep your skills current but don t have an employer to assist with the expense Send Bridget at info ultimateWindowsSecuritycom some kind of documentation redacted of course that verifies your status If you do that and if you were already on this email list prior to today we will find a way to make it work 4 Can t get your boss to pay for the course but have 2 or more colleagues who d like the course too Send us an email with how many are in your group and we ll arrange a group discount 10pourcents off for everyone for each person in your group up to 50pourcents Again, email info ultimateWindowsSecuritycom and Bridget will take care of you 5 Feeling left out Feel the love instead Take 25pourcents off SLS-OI, if purchased in February 2013 with coupon code LOVE You get the idea I m passionate about the security log I really want as many people as possible to have professional-grade competence in this area It s good for business, it s good for the industry, and it s good for us geeks Any don t let my discounts suggest SLS-OI is expensive It s actually about half the cost of other premium, on demand infosec training which by the way doesn t include a hands-on lab like mine But we have to keep the lights on at the UltimateWindowsSecuritycom datacenter so thanks, thanks and thanks again for your support These discounts are only good through the end of February so don t delay See you out there keeping the bad guys at bay, Randy PS Interested in SLS-OI as a long term training resource for everyone in your department Email pbrander logbindercom with department size and Phil can provide a quote http://www.secuobs.com/revue/news/423921.shtmlhttp://www.secuobs.com/revue/news/423921.shtml Secuobs.com : 2012-12-25 22:50:05 - Security et al - Windows audit policy has evolved for 20 years and many people at Microsoft have come on gone The result is what one Microsoftie describes as good See http blogstechnetcom b askds archive 2011 03 11 getting-the-effective-audit-policy-in-windows-7-and-2008-r2aspx If you aren t careful you can easily end up thinking your systems are auditing the right security events when in fact they are not In this article I show you how to avoid these problems The original audit policy in Windows NT was 7 audit policies corresponding to 7 categories in the Windows security log Along came Windows 2000 with Active Directory and that increased to 9 You configured those settings in group policy under Computer Configuration Windows Settings Security Settings Local Policy Audit Policy Easy Then with Windows 2008, Microsoft and apparently more specifically, Eric Fitzgerald, then security log czar at Microsoft, made a LOT of changes to the security log in a project called Crimson All security log event IDs changed from 3 digits to 4 Some events were split into multiple new ones, other legacy events were merged into a single new event ID New categories were added for new security events for the Windows firewall and other features To handle the new events and to respond to customer pressure to improve the granularity of audit policy, each of the 9 audit categories gained multiple new subcategories Microsoft should have just done away with the original 9 but probably didn t for backward compatibility It would have saved untold confusion that exists till this day and the arrangement of the subcategories in to the legacy 9 categories does not make sense eg what are IPsec events doing in the Logon Logoff category Anyway you could supposedly configure Windows using either the top 9 audit categories or the new subcategories But no one would want to do that because the new subcategories for the Windows firewall are scattered through the original 9 categories and are extremely noisy making almost everyone want to disable them You can only pick and choose between subcategories if you tell Windows to ignore the legacy 9 In Windows 2008 there was no way to configure subcategories from group policy you had to use the auditpol command on each system With Windows 2008 R2 Microsoft added Advanced Audit Policy Configuration to a completely different place in Group Policy and put the Audit Force audit policy subcategory settings Windows Vista or later to override audit policy category settings under Security Options Now, as long as you know to ignore the legacy 9 categories, enabled the Audit Force subcategory option and configure your Advanced Audit Policy Configuration you can safely use to group policy to centrally configure audit policy across your Win2008 systems By the way you can use the same GPO to manage audit policy on Win2003 and XP systems They will ignore the new subcategories and that security option and just look at what you configure on the legacy 9 categories But Microsoft never finished adjusting other areas of Windows policy management to fully support the new subcategories This means that policy reporting tools you depend on like Group Policy Results Wizard may very well lie Also, unlike most other security settings, local administrators can use auditpol to temporarily override the audit policy you push down from group policy You heard me right Just open a command prompt and change audit policy with auditpol and you can disable any subcategories you like until the next time group policy refreshes By the way, on laptops disconnected from the domain, this does NOT take affect by running gpupdate or rebooting I just tested it from my hotel The policy reverts to what it should be only once you re-connect to the domain This is really sad because in order to enforce accountability over admins, we need audit log integrity What can you do Continue to monitor for 4719 audit policy change and 1102 audit log cleared I always like to say, While admins can cover up their tracks, they can t cover up the fact they covered up their tracks Where does all of this leave us Here are my Best Practices Commandments for Win2008R2 Win7 Audit Policy Configuration 1 Do not use Local Security Policy 2 Do not use auditpol set 3 Use group policy objects in AD to configure audit policy 4 Always enable Audit Force audit policy subcategory settings Windows Vista or later to override audit policy category settings and, for Win2008R2 systems, ignore the 9 legacy audit categories 5 Configure all of the advanced audit policy subcategories even if it is just to explicitly disable them 6 Do not use Local Security Policy, Group Policy Results Wizard, RSOP or gpresults to verify what your true audit policy is 7 Use only auditpol get category to verify what your true audit policy is on a given system 8 Monitor for 4719 where user is not the system itself This indicates someone is temporarily overriding your official audit policy defined in AD GPOs Terminate them Seriously though, it is indicative of something bad Hope this helps and I want to thank SolarWinds Log Event Manager for sponsoring this article http://www.secuobs.com/revue/news/418660.shtmlhttp://www.secuobs.com/revue/news/418660.shtml Secuobs.com : 2012-12-15 01:04:52 - Security et al - This article was first published at Lumension s Optimal Security blog http bloglumensioncom 6036 growing-threat-from-friendly-fire-from-vendors After we learned that Flame exploited Microsoft s Auto Update infrastructure, I pointed out that if attackers were able to compromise Microsoft, a leader in patch management, it couldn t be long before bad guys exploited the update infrastructures of other vendors who are far behind Microsoft like Adobe And that s exactly what happened a couple weeks ago One of Adobe s internal servers was hacked This server performed code signing for several Adobe applications Code signing on the Windows platform is called Authenticode It s a way of digitally signing programs so that when you download what you believe to be Acrobat Reader from Adobe you can be sure that it really is Reader and not some piece of malware Once they hacked this code signing server at Adobe, the attackers used it to sign an unknown quantity at least 3 of malware files which were later used in some apparently limited, targeted attacks Adobe decommissioned the server, informed customers, released updated versions of Adobe apps signed by a new certificate and finally revoked the compromised certificate days later It s important to understand that the risk in this particular case was not any vulnerability inside Adobe products already installed The risk was that your computers might trust malicious software they encounter because it had a completely valid signature from a trusted publisher Why then was it necessary to update your Adobe apps Adobe never really got into details on that They were pretty vague, saying something about negative impact on user experience My research indicates that once Adobe revoked the certificate in question, User Account Control UAC and AppLocker among other things would balk when you tried to run or install Adobe apps signed with the old certificate Adobe s whole handling of the mess left me and a lot of my colleagues with a bad taste in our mouth It really felt like their priority was protecting their application s usability over user security They are where Microsoft was years ago when IIS was getting hacked all the time and whenever I used the words Windows security in that sequence, people would say isn t that an oxymoron Microsoft almost lost the king of the server hill to Linux and Apache but then Bill Gates came out with Trustworthy Computing This was a major turnaround for a man and a company who once said users would never pay for quality Microsoft developers stood down on development work for weeks of training and then went back to their source code searching for security vulnerabilities They implemented new coding standards and completely revamped their patch process Patch Tuesday brought order to the chaos of unpredictable patch releases and things got a lot better for the good guys For a while Microsoft s improvements created a vacuum in the ISV world and the bad guys turned their attention there Now we have the Acrobat, Flash, Shockwave, Java, iTunes, 3rd party browser security patching mess we find ourselves in now This has been going on for several years without much discernible improvement What s new is that in an ironic twist of fate the bad guys are exploiting software update infrastructures the very infrastructures our vendors are trying to protect us with There s consensus among the people I talk to that we can t trust software vendors to automatically update our systems We can t trust them to keep their infrastructures secure After all, everyone is vulnerable to advanced persistent threats APTs But when companies are hacked it s usually their own data that gets compromised But with ISVs, it s their users Like one of my community members said, if your ISV sneezes you get the pneumonia That s bad enough but I also don t think we can trust ISVs act 100pourcents in our best interests when handling security incidents that expose us, their users, to risk If we can t trust on those 2 points, there s 2 ways we can t trust ISVs First, we can t trust them to automatically update our systems We ve got to disable all of these automatic updates and take centralized control of patch management In fact I propose the following 8 Software Patching Commandments 1 Thou shalt not depend on vendor automatic updaters 2 Thou shalt not allow patch installation based on code-signing certificates 3 Thou shalt control which patches go down and when 4 Thou shalt be able to deploy patches within hours 5 Thou shalt be able to deploy patches in phases 6 Thou shalt not be blind to patch deployment status 7 Thou shalt patch software from multiple vendors 8 Thou shalt patch applications on all your operating systems Second, we can t trust code signatures It may be from Microsoft or Adobe, then again it may be a forged signature hiding some really bad malware You can t trust users not to run malware and it s evolving to fast That means we need to take centralized control of what executes on all servers and endpoints There s no substitute for application whitelisting and that technology has really improved There s great technology for both of these centralized control needs and I don t see any way around the need for it because we can t trust the classic mechanisms in place Oh, one other point about trust Don t trust vendors when they say the great majority of you are safe because these attacks are very targeted and limited in nature That s fine as long as you aren t the one being targeted All of them say this including Microsoft but I ll quote Adobe We have strong reason to believe that this issue does not present a general security risk The evidence we have seen has been limited to a single isolated discovery of two malicious utilities signed using the certificate and indicates that the certificate was not used to sign widespread malware That is damage control talk If you want more on the Adobe code signing hack and how it demonstrates the need for centralized, multi-vendor patch management and application whitelisting watch my webinar Code Signing Debacle 20 A Hacked Adobe Server and Its Impact on Us All This article was first published at Lumension s Optimal Security blog http bloglumensioncom 6036 growing-threat-from-friendly-fire-from-vendors http://www.secuobs.com/revue/news/417183.shtmlhttp://www.secuobs.com/revue/news/417183.shtml Secuobs.com : 2012-11-25 01:06:45 - Security et al - This whitepaper by Randy Franklin Smith, provides an overview of the 4 different logs in SharePoint and discusses their relative merits in terms of security value and how to integrate with your SIEM Click here to download it now http://www.secuobs.com/revue/news/413228.shtmlhttp://www.secuobs.com/revue/news/413228.shtml Secuobs.com : 2012-11-16 22:27:38 - Security et al - This whitepaper by Randy Franklin Smith, provides an overview of the 3 different audit logs in Exchange and discusses their relative merits in terms of security value and how to integrate with your SIEM Download it now here http://www.secuobs.com/revue/news/411935.shtmlhttp://www.secuobs.com/revue/news/411935.shtml Secuobs.com : 2012-11-06 23:36:49 - Security et al - Over at LOGbinder we've released a new whitepaper explaining how LOGbinder SP is the only recognized solution for providing reliable audit information about the security events of SharePoint via HP ArcSight and how it works with many other SIEMs Did you know that SharePoint generates several different logs ranging from true audit logs to diagnostic trace logs and usage analysis This brief will identify what if any security intelligence can be learned from each log It will then explain which logs are readily available to SIEMs, and which logs are not readily available Click here to download the whitepaper http://www.secuobs.com/revue/news/409963.shtmlhttp://www.secuobs.com/revue/news/409963.shtml Secuobs.com : 2012-10-21 22:25:55 - Security et al - This is a PowerShell script I developed to use in my own IT audits of Active Directory and for a webinar 10 Steps to Cleaning Up Active Directory User Accounts and Keeping Them that Way It outputs a comma-delimited list of user accounts and their most important properties for IT audit and account management analysis Check it out here http://www.secuobs.com/revue/news/406892.shtmlhttp://www.secuobs.com/revue/news/406892.shtml Secuobs.com : 2012-10-15 15:53:49 - Security et al - I recently completed a whitepaper for HP ArcSight that details the available logs in Microsoft Exchange and how you can connect those to HP ArcSight Even if you are not an ArcSight user you will still want to read this to see which logs are available for auditing in Exchange since our LOGbinder EX application wwwlogbindercom will be able to get these logs in to any SIEM not just ArcSight Click here to read the whitepaper http://www.secuobs.com/revue/news/405599.shtmlhttp://www.secuobs.com/revue/news/405599.shtml Secuobs.com : 2012-10-08 16:07:19 - Security et al - I recently wrote a whitepaper on protecting the unstructured data in your environment Unstructured data is a critical security risk and compliance concern for organizations Your company's emails, documents and spreadsheets contain readily digestible, business-critical information, and your organizatioon is generating more - much more- of those documents every day How are you protecting that data My whitepaper explains what you can do and how to do it You can read it here Randy's White Paper http://www.secuobs.com/revue/news/404201.shtmlhttp://www.secuobs.com/revue/news/404201.shtml Secuobs.com : 2012-10-02 20:29:36 - Security et al - This code signing hack at Adobe and the available information still leave a lot of unanswered questions No one I ve talked to has been able to get to the bottom of it Here s what have put together One of their code-signing servers got hacked and was used to sign some malicious software We know of 3 files and their hashes which are listed at http wwwadobecom support security advisories apsa12-01html Were other files signed We do not know How can I protect against the 3 files we know were signed Create Software Restrictions in Group Policy based on the file hashes How can I protect against any other files that were signed Intelligent whitelisting join me for my webinar tomorrow to learn more Can you add the relevant Adobe certificate to your Untrusted Certificates store Adobe says doing that won t stop the malware signed with the certificate but will create a negative impact on the user experience and execution of valid Adobe software signed with the impacted certificate Adobe does not recommend using the Untrusted Certificate Store in this situation http forumsadobecom message 4741942 4741942 What exactly is the negative impact I assume legit Adobe apps won t run What do I need to do Adobe says we need to install updated versions of about 30 applications http helpxadobecom x-productkb global certificate-updateshtml main-pars_header_8 What will happen if I don t update those applications What is the risk of not updating I can find no explanation at all on this The FAQ specifically asks this question but I don t get much from the answer Adobe is issuing updates for all impacted products to provide customers with software code signed using a new digital certificate To determine whether an update signed using a new digital certificate is available for your Adobe software installation, please refer to Security certificate updates I m going to cover all the issues in more depth in tomorrow s webinar and provide short term tactical suggestions and long term strategic recommendations for this new kind of threat that leverages compromised software vendor update infrastructures to deliver and or trick your computers into running malicious code Lumension has agreed to sponsor this webinar and their software update and application whitelisting experts will be joining me Please don t miss this timely real training for free TM session http://www.secuobs.com/revue/news/403108.shtmlhttp://www.secuobs.com/revue/news/403108.shtml Secuobs.com : 2012-09-26 20:43:05 - Security et al - Folks, here s a podcast version of a fascinating webinar I just did with Richard Wang who runs SophosLabs Richard and his team are on the front line of today s war against malware One of the most interesting infosec conversations I ve had in a long time I hope you enjoy it as much as I did Click here http owly e0YzL http://www.secuobs.com/revue/news/401958.shtmlhttp://www.secuobs.com/revue/news/401958.shtml Secuobs.com : 2012-09-21 20:51:25 - Security et al - I just wanted to let you all know that I have a few new partners that have joined our SIEM Synergy Partner Program over at LOGbindercom I would like to welcome SolarWinds and Prism Microsystems as certified partners along with our existing partner GFI How does this program benefit you as the end user At my software company LOGbinder, we've worked closely with these vendors to not only integrate LOGbinder into their SIEM solutions but also package together some prebuilt rules, alerts and reports This allows you to install LOGbinder in your environment and then have my recommended reports and alerts at your fingertips in no time Don't see your SIEM solution listed as a partner Not a problem At LOGbinder we currently have a long list of prospective partners who we are working with to get certified as a SIEM Synergy Partner Send us an email and let us know who your SIEM solution provider is and we'll let you know if we're already working with them or if we need to reach out to them to get started Are you a SIEM provider and want to work along with us to get SP, SQL, or EX logs in to your SIEM simply email us and we'll get the process started We have some other important news coming soon so you may want to subscribe to my list over at LOGbinder Click here to do so http://www.secuobs.com/revue/news/401132.shtmlhttp://www.secuobs.com/revue/news/401132.shtml Secuobs.com : 2012-08-17 02:26:14 - Security et al - I ll be presenting a session entitled Everything Matters Every Setting, Every Component, Every Technology at SecuritySCAPE 2012 which is a really cool IT security virtual event, bringing together industry analysts, thought leaders and IT professionals into an online forum to share real-world experiences, best practices, and identify future trends and challenges that we will all face In addition to me you ll hear from Neil MacDonald from Gartner Group, speakers from Aberdeen Group, Securosis, Forrester Research and security experts like Richard Stiennon Get the full details and sign up here SecuritySCAPE 2012 You might get an iPad 3, too http://www.secuobs.com/revue/news/394186.shtmlhttp://www.secuobs.com/revue/news/394186.shtml Secuobs.com : 2012-08-06 20:45:00 - Security et al - Triathlon, pentathlon, just a few more days of the Summer Olympics are left but there s one more event happening in mid-September Randy Franklin Smith s Quadrathlon On September 12 I will be taking on the audit logs of Microsoft s 4 top enterprise server products SharePoint SQL Server Exchange Windows Servers Yeah, it s a quadrathlon but don t worry, you aren t the runner I am and I plan to be exhausted at the end More information here http://www.secuobs.com/revue/news/391931.shtmlhttp://www.secuobs.com/revue/news/391931.shtml Secuobs.com : 2012-06-29 22:12:09 - Security et al - In conjunction with integrating SolarWinds Log and Event Manager LEM with my LOGbinder software I had an opportunity to get to know LEM and I thought I d share some of the highlights of what I discovered For me, the most important thing about a log management SIEM tool is its analysis functionality How much built-in intelligence does it have about common event logs and how powerful are its capabilities for alerting you to important activity, reporting for compliance and adhoc research LEM employs my favorite SIEM feature for increasing maximizing analytical power normalization Architected for Normalization With normalization, your SIEM vendor compiles schema of log source agnostic event types that are common to nearly any technology These event types include things like - File operations - User account maintenance - Group membership changes - Configuration changes - Network traffic events SolarWinds provides connectors for common log sources that understand how to translate raw events from a specific log source into their equivalent normalized event type For instance the screen print below shows a search based on Alert Type New Group Member in LEM, alerts are any events of interest that is not discarded IMAGE When you query for this Alert Type you will get any group membership additions from all monitored log sources In the example above you see a member added to a Windows local group as well as a new member added to a group in SharePoint That screen print really illustrates the power of normalization You no longer need to be an expert in every arcane log format produced within your organization It s hard enough to learn the Windows event log much less all the other security logs found on a typical network As raw events come into LEM, the appropriate connector compares the event to its alert criteria and discards unmatched events The remaining events are normalized into alerts This processing takes place in the local agent which increases efficiency since unimportant events are discarded at their source The normalized alerts are then fed to the central LEM manager over an encrypted connection which ensures security and audit integrity At the manager, alerts are processed according to the alert distribution policy Each alert may be dispatched to one or more of the following 1 Alert Correlation Engine 2 Console for display in dashboard Widgets or in filter views 3 Storage for future reports and analysis Automated Response through Rules The Event Correlation Engine is where Rules are processed Rules define automated responses to correlated alerts LEM makes it easy to define rules You essentially build a graphical flow chart of the rule by dragging and dropping conditions, actions and Boolean logic operators on to the rule canvas no cryptic data entry here The automated responses you can select range from sending emails to your security analyst, to killing offending processes, updating a user defined list or creating an incident The latter 2 are particularly interesting Incidents are a special kind of what I would call meta-alert in LEM You can define rules to trigger Incidents from any alert that should be followed up on and for which you need to document such follow up While LEM documentation suggests printing out a daily incident report and noting your follow up and signoff on the hardcopy, I think it would be more efficient to have the report emailed to a SharePoint document library In the document library you could add additional columns or workflows for documenting follow up and signoff User defined lists called custom groups in LEM allow you to compare alerts against any list of items you define For instance, you could create a list of privileged users and then define multiple rules that use that same list to identify activity where the actor or target is a privileged account Of course the disadvantage of such lists would be the burden of keeping them up to date That s where the user defined list actions come in so handy You can automate the maintenance of user defined lists For instance you could create a rule for new group member alerts where the group is Administrators, Domain Admins or Enterprise Admins Then set a response action that adds the new member s name to a Privileged Accounts list and a rule to handle the opposite case where a user is removed Of course to handle nested groups you d need to handle some additional logic but a couple additional rules for maintaining an Admin-Equivalent Groups list would do the job Interactive Analysis The LEM console provides three levels of interactive analysis Starting on the Ops Center tab see below you have a pane of customizable dashboards called widgets IMAGE A Widget is a visualization eg simple table or a pie bar line chart combined with a filter that controls which alerts are represented in the Widget This makes it easy to define key security indicators and keep an at-a-glance eye on them You can drill down into a Widget which takes you to the next level of analysis the Monitor tab see below IMAGE The monitor tab allows you to select a filter which displays on the right, the alerts matching that filter Then when you select an alert, its details are displayed on the bottom pane When you enter the Monitor tab via a Widget drilldown back on the Ops Center tab, LEM automatically selects the same filter as the Widget you just came from making it easy to see the activity behind the Widget You can select any data value in the Alert s details and select Explore which takes you to the 3rd level of analysis the nDepth display on the Explore tab see very first screen print nDepth is a really cool way to do adhoc analysis of security log activity At its root, nDepth is a search application that allows you to enter search terms in a single, Google-like search field And then of course the matching alerts are displayed in a list underneath However the capabilities go far beyond that simple description In addition to displaying matching events as a simple list, you can choose to visualize the data in a variety of chart formats, word clouds, tree maps and more Whenever you change your search criteria, LEM adds your old criteria to the History list Whenever you build a search you like and want to re-use you can save the search and it appears in the Saved Searches list This makes it easy and superfast to go back to recent searches or searches you knew you d want to use again nDepth provides a number of ways to make it easier to refine your search In the Refine Fields pane you see a list of all the field names found in the current result set Under each field name you find a list of all the values occurring for that field along with their count You can drag any of these field names or values to the search terms field and nDepth will automatically add a Boolean expression that further filters the results You can highlight DNS names and IP addresses and run lookups like Whois, traceroute, NSlookup Or you can on demand have any of the actions available to Rules described above to be executed on the manager or agent system Wrapping Up Beyond these three highly interactive and progressively deeper analysis tools, you can also schedule reports to be automatically produced and delivered via email LEM runs as a physical or virtual Linux appliance, the latter being easy to download and quickly set up to run in your hypervisor Being a Linux appliance makes it easy to setup the appliance as a separate isolated log management with access controls to prevent tampering by admins of the systems you are monitoring which is an important architectural consideration if you are depending on your SIEM to provide accountability over admins And though it s a Linux system, you don t really need to be a Linux guru because the appliance can be almost completely managed via the desktop console which runs on your workstation SolarWinds hosts an active user community called Thwack where you can exchange filter, report and rule content, request new features, keep up with new developments and get help from SolarWinds and community members SolarWinds Log and Event Manager is a capable SIEM software solution that incorporates my favorite SIEM feature normalization The interface is highly visual with very few instances where you must enter cryptic text and codes You can download a trial of LEM from http wwwultimatewindowssecuritycom rediraspx name sw_reg http://www.secuobs.com/revue/news/384665.shtmlhttp://www.secuobs.com/revue/news/384665.shtml Secuobs.com : 2012-06-14 00:03:40 - Security et al - I know from the emails I receive and site stats that hundreds of thousands of people over the years have made use of the information at UltimateWindowsSecuritycom I m excited to announce that we have made some major updates 1 I ve added all of the event ID s for both SharePoint audit logging and SQL Server 2008 s totally new audit log in to my Security Log Encyclopedia 2 I ve added two new sections to the site itself SharePoint and SQL Server audit logging SharePoint Audit Logging With SharePoint being used these days to store more and more sensitive data, it s imperative that you control and know who is accessing what In this new area, I explain How to enable and control SharePoint Audit Logging for end-users and admins How the SharePoint audit log is stored Explain the SharePoint audit policy How to get reporting and alerting from the SharePoint audit log How to get your SharePoint audit log in to a SIEM solution Introduce you to LOGbinder SP and how it fills the gaps in SharePoint audit logging SQL Server Audit Logging SQL Server 2008 introduced a totally new audit logging facility which is critical to enterprises storing sensitive information and or processing important transactions in today s demanding compliance environment In my new SQL Server section at UltimateWindowsSecuritycom I explore The SQL Server audit policy Sift through the granules of SQL Server auditing and break down Server and Database audit specifications Deep dive in to each audit action group, what it does, and each event ID it contains Provide you with access to my free Audit Policy Wizard Click any of the links above or visit UltimateWindowsSecuritycom for more information http://www.secuobs.com/revue/news/381445.shtmlhttp://www.secuobs.com/revue/news/381445.shtml Secuobs.com : 2012-06-07 22:05:53 - Security et al - Just a quick heads up that changes are coming - actually some pretty good sounding enhancements - to auditing in Windows Server 2012 We are finally getting expression-based audit policies which will hopefully make it possible to define super granular audit policy and finally configure the noise out of the security log Also there are enhancements to file access, user logon auditing and new support for removable storage devices Stay tuned - I'll surely be posting more info as I work with the actual bits Not to mention great webinars on the new features http://www.secuobs.com/revue/news/380241.shtmlhttp://www.secuobs.com/revue/news/380241.shtml Secuobs.com : 2012-06-07 04:57:46 - Security et al - Is it just me or does the placement of this option automatically necessitate a KB article just so that you can find it I know Too much time on my hands But even an old cynic like me cracks at some point http://www.secuobs.com/revue/news/380040.shtmlhttp://www.secuobs.com/revue/news/380040.shtml Secuobs.com : 2012-06-05 21:21:05 - Security et al - Originally posted at Lumensioncom Whenever I think about detecting and defending against today s sophisticated threats I keep coming back to the same question, How do you distinguish legitimate activity from malicious That is not an easy question to answer For instance, read access by an authorized user or by a zombie process running on that user s computer looks the same in an audit log As soon as you trying to detect anomalies like alerting on activity at seemingly odd times of the day you also create a stack of false positives for security analysts to wade through One industry in particular that I think is doing a horrible job of malicious behavior detection is the credit card industry It s such a hassle to buy anything online today that sometimes I wonder if it isn t better to just take cash to a store Anything out the ordinary causes your card to be locked, shipments held up and the necessity of making phone calls to customer service either at the merchant or credit card company and who has time for that There must be a better way But to find that better way you have to get imaginative and start with some crazy ideas so here s a few for starters CAPTCHAs Use CAPTCHAs internally as an added gate to keep automated malicious tools from accessing sensitive information OK, nobody likes CAPTCHAs - I understand that Maybe, I m already starting down the wrong road here but think about the concept and maybe you ll come up with a better idea What does a CAPTCHA do It helps provide assurance that the person accessing your system is a human and not some kind of bot So, do you have a sensitive web-based application or repository of sensitive information like SharePoint Normal user authentication does not keep out bad guy programs running on the PC of a duly authorized user But throwing up a CAPTCHA would stop such malware until the bad guys add CAPTCHA bypass technology or more start passing interactive sessions through zombied computers Split Internet Access A long time ago I provided some training to a very secure military base They had 2 networks classified and de-classified going to each PC with an A B switch between each PC and the 2 networks Each PC had a 2 removable hard drives To access the Internet they d boot on the declassified drive and select the declassified network on the A B switch and vice-versa for classified access There were controls in the operating system to prevent a system booted on the classified drive from communicating if they mismatched the drives and network selection All the drives went into a safe before each worker left I m not talking about doing that now But there are other ways Here s one and remember I don t claim this will be viable for every environment out there but it will be for some and more importantly, grasp the core concept which is to give users access to the Internet while preventing sensitive data and applications from touching the Internet So here s the idea Block the majority of your user PCs from accessing the Internet Notice I didn t say block the users just their PCs How do you do that Yes, a proxy server is a start but it s still not good enough Instead deliver their Internet browsing experience to them via thin-client For instance deliver Internet Explorer to end-users as a RemoteApp running on a Remote Desktop Server Firewall the server so that end-user PCs can only communicate via RDP Lock down the session configuration to prevent drive sharing, etc Now users can browse the web but none of the content they access touches their PC At most, any malware will infect the RDS system which is firewalled off from the Internal network and can be re-imaged every night and that system Of course you ll have to make exceptions for users that really need to be able download files from the Internet or run other applications that really do need to open outbound connections And we haven t solved the incoming email problem which is admittedly a key infiltration vector for APTs such as the one that hit RSA a while back The biggest issue with incoming mail is how to handle attachments Maybe mail client eg Outlook should run on the RDS as well You could allow copy and paste between RDP sessions and the real desktop without exposing yourself to the majority of malicious content risks encountered today since most exploit malformed data structures in the file format and are only going to impact the application that directly parses the data This method would keep malware off the user s local desktop, it would keep the malware out of the internal network and prevent the malware from impersonating the end-user who is targeted by it So if you can t actually implement either of the methods, how can you or at least software vendors make something similar possible When a system encounters an access request to a resource from a user with the appropriate permissions, how can the system ensure that the request is really initiated by the user and not a zombie process running on the user s PC How can we allow users to access the Internet and internal applications while keeping some kind of boundary in place between the network and storage accessible to Internet applications browsers, email clients and internal applications And how do we provide for exceptional applications that must bridge that boundary Could operating system vendors add a flag to processes that insulate Internet, internal applications and hybrid applications from each other similar to the memory protection that already exists between processes or the kernel user mode boundary And could they build a new IPC interprocess communication method that allows data to safely cross this boundary in a format that precludes executable code Or is there a better idea I hope you have one because we need it Originally posted at Lumensioncom http://www.secuobs.com/revue/news/379650.shtmlhttp://www.secuobs.com/revue/news/379650.shtml Secuobs.com : 2012-05-01 22:39:18 - Security et al - I am excited to announce the release of our latest audit logging agent over at LOGbindercom Introducing LOGbinder SQL Our LOGbinder SQL agent enriches SQL Server s cryptic and generic audit messages to produce easy-to-understand audit log events Similar to LOGbinder SP, these events can be output to the Security log a custom Windows event log, where any log management or SIEM solution can collect, alert, report, and analyze SQL Server Audit Log Processing SQL Server 2008 introduced a totally new audit logging facility which is critical to enterprises storing sensitive information and or processing important transactions in today s demanding compliance environment SQL Server Audit is flexible in terms of audit policy and comprehensive in relation to the breadth and depth of objects and actions that can be audited However, the audit data generated by SQL Server needs additional refinement and processing before it can be relied upon as a usable audit trail and managed by your existing log management SIEM solution Refines the cryptic SQL audit log The audit records generated by SQL Server audit are cryptic and difficult to understand Basically, one log record format is used for documenting everything from an insertion on a table to a modification of a stored procedure And while SQL Server can write events to the security log, it uses the same event ID for all events, and the IDs and keywords are not resolved Thus, it requires in-depth knowledge of the SQL audit model in order to decipher events Frees SQL audit logs from their proprietary format The preferred and highest performance option for audit log output results in a proprietary file format that cannot be parsed by log management SIEM solutions using typical text log file-based parsing engines Our new LOGbinder SQL agent processes the proprietary formatted SQL Server audit log and enriches SQL Server s cryptic and generic audit messages to produce an easy-to-understand audit log event which then outputs to the Windows event log, where any log management or SIEM solution can collect, alert, report, and analyze Enriches SQL audit logs without impacting SQL Server performance LOGbinder SQL can be installed either on the SQL server itself or, to eliminate any impact on business database functions, you can deploy a separate server with the LOGbinder SQL agent, processing audit logs from multiple SQL Servers via share folders Connects SQL Audit to Your SIEM LOGbinder SQL fills a critical gap between enterprise database servers and audit log management solutions, allowing you to obtain a clearly-written and easy-to-understand audit log that is accessible to your existing log management solution Similar to our efforts with LOGbinder SP, we will be working with log management and SIEM solution providers to build recommended alerts and reports into their systems for SQL server audit logs processed by LOGbinder SQL Download LOGbinder SQL Now Click here Or if you want further information on this new solution, please contact sales http://www.secuobs.com/revue/news/373012.shtmlhttp://www.secuobs.com/revue/news/373012.shtml Secuobs.com : 2012-04-18 19:19:51 - Security et al - I'm happy to let you know that with the recent release of LOGbinder SP 30 I've updated our Recommended Alerts and Reports for SharePoint LOGbinder SP which you can find at http wwwlogbindercom products logbindersp resources reportsaspx Updates include coverage of new events and features in LOGbinder SP 30 new recommended alert rules important notes and explanations regarding insertion strings , how date time works in LOGbinder SP and information about the 2 possible event log sources that LOGbinder SP events can bear This free resource is valuable for anyone looking for tips and recommendations on creating reports or alert rules for SharePoint audit events http://www.secuobs.com/revue/news/370708.shtmlhttp://www.secuobs.com/revue/news/370708.shtml Secuobs.com : 2012-03-19 19:13:44 - Security et al - I have 2 rules of thumb when it comes to audit logging First, if it has a log I recommend enabling it as simple as that The only exceptions are prohibitively verbose logging options associated with debugging or the surprisingly rare case where logging has an impact on performance Second, if you can collect the log and archive it with your log management SIEM solution, do it - even if you don t set up any alert rules or reports I ve repeatedly seen the value following these 2 rules for several reasons First, you really never know what audit log data will be valuable in a forensics situation and there is no way to reconstruct log data after the fact Enable auditing beforehand or forever hold your peace The most obscure or seemingly unimportant systems and applications may end up being crucial to determining the extent or root vector of an intrusion or critical to building your case in insider investigations One time I was called upon to help document a case of inappropriate behavior by a user and the client program for a popular Internet provider who at the time provided a log which proved very helpful in showing the user accessed certain forums at specific times linked to the actions being investigated Security events that you don t necessarily monitor and respond to may also be valuable in providing documentation that you performed certain actions when necessary as part of a compliance related matter For instance in my standard audit recommendations for Active Directory I suggest auditing and archiving events related to the disabling and deletion of accounts and group membership removals There is typically no need to review these events but when the auditor comes around you can use them to document that you removed access in response to changes in employee status and role Finally, audit logs even if not reviewed can serve as a powerful deterrent against malicious actions and policy violations by end users and administrators alike If they know that their actions are being recorded and can be looked up and used against them in the future they will be much less likely to take chances But that s only true if the audit logs are collected an archived to a system separate from the people being monitored Otherwise, especially in the case of administrators, logs a vulnerable to deletion or tampering What are some common logs that you should consider enabling and if possible adding to your log management process for collection and archival besides the obvious candidates like your domain controller security logs First and foremost, I strongly recommend you enable appropriate auditing on member servers and at least securely archiving them with your DC logs Many of the most critical security events on your network are only caught by your member servers This would include attempts to break into member servers with local accounts, security configuration changes, programs executed and files accessed Then like I stressed in last month s article there is a wealth of security information in your workstation security logs I understand that you have a lot of workstations and it may be a challenge to collect and archive that many logs and that amount of data, but at least enable auditing on those workstations Set maximum log size to 300MB and chances are the audit data will be there when you need it even if you aren t centrally managing them Besides the Windows security logs of all your systems, what are other good candidates for logging I highly recommend enabling DHCP server logging because many other security logs list the IP address but no other information to identity to identify the client If you have your DHCP logs you can look up that IP address and date and time against the lease events to figure out the MAC address and likely the computer name of the system that had that IP address at the time the event was recorded If you use RRAS Routing and Remote Access Server be aware that it has client authentication and connecting logging capabilities which record important events not sent to the Windows security log The same goes for IIS IIS can log every incoming request to any web based application you host including URL, verb, result code, client IP address and more This is critical for tracking down attacks against your website and other web based applications More and more companies are beginning to store and process security and compliance critical information in SharePoint and SharePoint too has an audit log capability Exchange 2010 has a new non-owner mailbox activity log and a new administrator audit log VMWare has an audit capability that is critical to ensuring accountability over your virtualization infrastructure SQL Server 2008 has a new audit log too Even Microsoft Dynamics CRM 2010 has an audit capability It seems like every software vendor is seeing the need to provide audit trail capability which is good news for information security but it also means we need to learn how to at least turn on these new audit features and ensure we don t inadvertently consume too much storage or other resources And remember, there s good reason to enable auditing even if you aren t regularly reviewing or monitoring the logs If at all possible get these logs out of the systems and applications where they are generated and into your separate and protected log management SIEM solution so that the integrity of these audit trails in ensured Follow these steps and chances are you will score points in the future when you can explain who did what and when they did it http://www.secuobs.com/revue/news/364654.shtmlhttp://www.secuobs.com/revue/news/364654.shtml Secuobs.com : 2012-02-16 22:13:51 - Security et al - I never have to convince people that monitoring Domain Controller security logs is important With member servers on the other hand I sometimes have to explain why those security logs are important but that s not difficult because folks, and management in particular, understand that member servers is where our data is But when it comes to workstations I often face an uphill battle helping people understand why workstation security logs are so important Frequently I hear things like but we have a policy that forbids storing confidential information locally Be that as it may workstations and especially laptops always have sensitive information on them there s no way to prevent it Besides applications like Outlook, Offline Files and SharePoint workspace that cache server information locally, there s also your page file which at any time can contain content from any document or other information you are working with But even if there were no confidential information on your workstations, their security logs are still very important to your enterprise audit trail, forensics and for detecting advanced persistent threats There s a wealth of audit trail information logged by workstations that you can t find anywhere else and consequently a host of questions that can only be answered by workstation logs First of all, if you care about when a user logged off, you can only find this information in the workstation s security log Domain controllers audit your initial authentication when you logon to your workstation but essentially forget about you after that You can t figure out logoff times based on shared folder connections because Windows does not keep network logons open to file servers between file accesses So, when you logout from Windows, the only computer on the network that logs this is your workstation And what about logon failures Yes, domain controllers do log authentication failures but the events logged are tied to Kerberos and the error codes are based on RFC 1510 s failure codes Kerberos failure codes are not as granular and do not map directly to all the reasons a logon can fail in Windows Therefore some authentication failure codes provided in event IDs 4768 and 4771 can mean any one of several possible reasons For instance, failure code 0x12 which Kerberos defines as Clients credentials have been revoked can mean that the logon failed due to the account being disabled, locked out or outside of authorized logon hours With today s focus by bad guys on the endpoint you also need to know if someone is trying to break into to a workstation If the attacker is trying to break into the workstation with a domain account you can find evidence of this in your domain controller security logs by looking for the same to events mentioned above However workstations also have local accounts and these are big targets for attackers since local accounts are often poorly secured and tend to fly under the radar in terms of security monitoring When you attempt to logon to a workstation with a local account, this activity is not logged on the domain controller Since the authentication is being handled locally the event is also logged locally in the form of event ID 4776 Don t let the description of this event throw you because it says The domain controller failed to validate the credentials for an account The event should say the system instead of domain controller because this event is logged on all types of computers You can track what files a user accesses on file servers with file system auditing on those servers but to have an audit trail of what programs the user is executing, that too is only logged on workstation security logs In forensic investigations I ve found that knowing what programs a user ran and for how long was crucial to documenting what occurred and making our case Furthermore, many of the advanced persistent threat APT attacks being waged depend on malicious executables run on end user workstations So you can t afford not to have a record of what s running on your endpoints Unfortunately, the Process Tracking aka Detailed Tracking category only logs programs run on the local computer therefore no information about end user desktop program usage is available in domain controller or member server security logs The only process events logged on servers are the actual server programs that execute there As you can see there s a lot of critical audit trail information only available if you enable auditing on your workstations Of course enabling auditing on workstations is one thing while collecting logs from thousands of additional computers is another In addition there are some very important workstation security events which Windows auditing does not record For instance, Windows does not audit when you connect or disconnect devices or removable storage like flash drives Much less does it record what files you transfer to or from the removable storage Nor does Windows audit the installation of software In a webinar I will present later this year in cooperation with Prism Microsystems I d dive more deeply into these issues and how to address them t s important that we all educate decision makers about why endpoint security and in this case audit logs from endpoints is so important We have to get beyond the mainframe inspired mindset that security only matters on the centralized systems where critical data resides Workstations are really just as important as any other component of a secure network If an attacker can compromise the workstation of a user with access to critical information the attacker can impersonate that user and access any information or applications that user has access to on the network Even workstations of users without access to sensitive resources are important because attackers, especially in APT, scenarios are happy to start with any endpoint as beach head and attack other systems from there Moreover workstations are arguably the most vulnerable components of your network since they process so much content from the Internet connected with web browsing and email, because they come into contact with potentially infected files on removable storage and because they connect to other insecure networks like Wi-Fi hotspots Keep an eye and be sure to register for this event and invite your manager http://www.secuobs.com/revue/news/358320.shtmlhttp://www.secuobs.com/revue/news/358320.shtml Secuobs.com : 2012-01-17 19:21:48 - Security et al - This month I m going to zero in on a specific area of audit logging that creates no end of confusion, and that is the difference between 2 categories in the Windows security log Account Logon events and Logon Logoff events These 2 categories are related but distinct and their names contribute to the confusion Let s start by calling Account Logon events what they really are authentication events I wish Microsoft had named the Account Logon category Authentication it would have helped a lot The way I remember it is, the A in Account Logon is for Authentication That being said, what is the difference between authentication and logon In Windows, when you access the computer in front of you or any other Windows computer on the network you must first authenticate and then you obtain a logon session on that computer Authentication is a point in time event A logon session has a beginning and end So are authentication events simply a duplicate of logon events No, and the reason is that authentication may take place on a different computer than the one you are logging into Workstation Logons ------------------ Let s start with the simplest case You are logging onto at the console aka interactive logon of a standalone workstation meaning it is not a member of any domain in fact let s say it s not even connected to a network The only type of account you can logon with in this case is a local user account defined in Computer Management Local Users and Groups You don t hear the term much anymore but local accounts are the same thing as a SAM account In this case both the authentication and logon occur on the very same computer because we simply logged on to the local computer using a local account Therefore you will see both an Account Logon event 680 4776 and a Logon Logoff 528 4624 event in its security log Note in this article I ll always note the 3 digit Windows 2003 event followed by the 4 digit Windows 2008 event Now let s make this workstation a member of a domain At this point it s possible to authenticate to this computer using a local account or a domain account or, for that matter, a domain account from any domain that this domain trusts We ve already discussed what happens when you logon with a local account so let s logon with a domain account Since the user specifies a domain account, the local workstation can t perform the authentication because the account and its password hash isn t stored locally So the workstation must request authentication from a domain controller via Kerberos So this time, the authentication event 672 4768 is logged on which ever domain controller handles the authentication request from the workstation Once the domain controller tells the workstation that the user is authentic the workstation proceeds with creating the logon session and a records a logon event 528 4624 in its security log What if we logon to the workstation with an account from a trusted domain In that case one of the domain controllers in the trusted domain will handle the authentication and log 672 4768 there, with the workstation logging 528 4624 the same as above In all such interactive logons , when you finally logoff, the workstation will record a logoff initiated event 551 4647 followed by the actual logoff event 538 4634 You can correlate logon and logoff events by Logon ID which is a hexadecimal code that identifies that particular logon session Accessing Member Servers ------------------------ After logging on to a workstation you normally re-connect to shared folders on a file server What gets logged in this case Remember, whenever you access a Windows computer you must obtain a logon session in this case a network logon session Intuitively you might assume that the logon session begins when you connect to the share and then ends when you disconnect from it usually when logging off your local workstation Unfortunately though, Windows servers only keep network logon sessions alive for as long as you have a file open on the server This accounts for why you see repeated logon logoff events on Windows file servers by the same user throughout the course of the day With network logons, Windows 2003 logs 540 instead of 528 while Windows 2008 logs 4624 for all types of logons When you logon at the console of the server the events logged are the same as those with interactive logons at the workstation as described above More often though, you logon to a member server via Remote Desktop In this case the same 528 4624 event is logged but the logon type indicates a remote interactive aka Remote Desktop logon I ll explain logon types next Something we often need to know, when looking at logon events is what type of logon are we dealing with Is this an interactive logon at the console of the sever indicating the user was physically present or is it a remote desktop logon For that matter the logon could be associated with a service starting or a scheduled task kicking off In all such cases you will need to look at the Logon Type specified in the logon event 528 540 4624 A full list of Logon Types is provided at the provided links for those events but in short Logon Type Description 2 Interactive logon at keyboard and screen of system 3 Network ie connection to shared folder on this computer from elsewhere on network 4 Batch ie scheduled task 5 Service Service startup 10 RemoteInteractive Terminal Services, Remote Desktop or Remote Assistance Events at the Domain Controller ------------------------------- When you logon to your workstation or access a shared folder on a file server, you are not logging onto the domain There s no such concept Each Windows computer is responsible for maintaining its own set of active logon sessions and there is no central entity aware of all everyone who is logged on somewhere in the domain After servicing an authentication request, the domain controller forgets about you it doesn t know how you were logging console, remote desktop, network, etc nor when you logoff But wait, you might say I see logon events on the domain controller, not just authentication events, whenever a user logs on to their workstation and then periodically after that OK, that s true on domain controllers you often see one or more logon logoff pairs immediately following authentication events for the same user But these logon logoff events are generated by the group policy client on the local computer retrieving the applicable group policy objects from the domain controller so that policy can be applied for that user Then approximately every 90 minutes Windows refreshes group policy and you see a network logon and logoff on the domain controller again These network logon logoff events don t tell you much, I regard them usually as noise In forensic situations they could give you a rough idea of how long the user was logged on since as long as the user remains logged on group policy will refresh about every 90 minutes The other possibly useful thing about these group policy related logon logoff pairs is that they help you infer that the preceding authentication events for the same user were in conjunction with an interactive or remote desktop logon as opposed to a service or scheduled task logon What about the other service ticket related events seen on the domain controller That requires an in-depth discussion of Kerberos and how it s implemented which is beyond the scope of this article Basically, after your initial authentication to the domain controller which logs log 672 4768 you also obtain a service ticket 673, 4769 for every computer you logon to including your workstation, the domain controller itself for the purpose of group policy and any member servers such as in connection with shared folder access Then as computers remain up and running and users remain logged on, tickets expire and have to be renewed which all generate further Account Logon events on the domain controller The Facts Good, Bad and Ugly ----------------------------- Both the Account Logon and Logon Logoff categories provide needed information and neither can replace the other you need both And, ideally, you really need both categories of events from all your computers including your workstations Here s a number of important facts you need to understand, and well accept 1 To determine definitely how a user logged on you have find the logon event on the computer where the account logged on You can only make some tenuous inferences about logon type by looking at the domain controller and that requires analyzing multiple events 2 To determine when a user logged off you have to go to the workstation and find the user initiated logoff event 551 4647 3 To correlate authentication events on a domain controller with the corresponding logon events on a workstation or member server there is no hard correlation code shared between the events Folks at Microsoft have suggested the Logon GUID field in these events would provide that but my research and experiments indicate that unfortunately the GUIDs are either not supplied or do not match So to make that correlation you basically have to dead reckon based on time, computer names and user account names 4 Account Logon events on domain controllers are great because they allow you to see all authentication activity successful or failed for all domain accounts Remember that you need to analyze the security logs of all your domain controllers security logs are not replicated between DCs 5 Account Logon events on workstations and member servers are great because they allow you to easily pick out use of or attacks against local accounts on those computers You should be interested in that because using local accounts is bad practice and bad guys know they tend to be more vulnerable than domain accounts But, you don t have to use Account Logon to detect logon attempts on local accounts you can use Logon Logoff events if you know what you are doing When viewing a Logon Logoff event compare the domain name in the event details to the computer name that generated the event if they match you are looking at a local account logon attempt otherwise the domain name field with reflect some domain So can you survive with only enabling Logon Logoff events on member servers and workstations I suppose so 6 Logon Logoff events are a huge source of noise on domain controllers because every computer and every user must frequently refresh group policy If you disable this category on domain controllers what will you lose You will lose some visibility into logons at the domain controller itself such as when an admin logs on at the console, via remote desktop or a service or scheduled task starts up In all cases Account Logon events will still be logged but see points 1 and 2 above 7 Basically, successful network logon and logoff events are noise on domain controllers and member servers because of the amount logged Unfortunately you can t just disable successful network logon logoff events without also losing other logon logoff events for interactive, remote desktop, etc My old adage is you can t configure the noise out of the Windows security log that s the job of your log management SIEM solution So that s the difference between Account Logon ie authentication and Logon Logoff events All things considered, I d like to see both categories enabled on all computers ideally I haven t seen these events create a noticeable impact on the server but the amount of log data might exceed your log management SIEM solution s current capacity If you can t afford to collect workstation logs, I still suggest enabling these 2 categories on workstations and letting the log automatically wrap after reaching 100MB or so Chances are the data will be there if you need it for forensic purposes http://www.secuobs.com/revue/news/352511.shtmlhttp://www.secuobs.com/revue/news/352511.shtml Secuobs.com : 2012-01-05 13:22:43 - Security et al - Dynamics CRM 2011 keeps us sane here at Monterey Technology Group, Inc as we manage a wide array of product and service offerings with a handful of people But CRM is missing some key features that seem like no brainers Thankfully I've found solutions to each been using them since CRM 40 and thought I'd share them 1 No way to print a quote to PDF and email it from within CRM in one step - crazy I know Solution ePDF from http downloadsmycrmgroupcom Incredibly easy to install Great support 2 Moving invoices from CRM to QuickBooks OK this isn't a missing feature but definitely a needed integration link Solution Inogics Inolink http wwwinogiccom integration_quickbookshtm Involved install process and you will probably need support but they are responsive and it does work 3 Converting incoming emails to CRM Queues to Cases - crazy I know For this I use c360's EmailToCase Least favorite solution and company out of the 3 but it gets the job done and their support staff do respond I think all of these support CRM Online in addition to on-premise http://www.secuobs.com/revue/news/350432.shtmlhttp://www.secuobs.com/revue/news/350432.shtml Secuobs.com : 2011-12-21 20:54:56 - Security et al - Was just messing with BitLocker today I enabled BitLocker on a Win7 computer that is a member of a domain but before configuring group policy to require BitLocker recovery keys to be backed up to AD before locking the drive So I enabled the Store BitLocker recovery information in Active Directory Domain Services policy I forced a group policy refresh on that PC Then I went to my domain controller win2008r2 and opened that computer account First problem no BitLocker tab on the computer account's properties dialog Had to open Server Manager and add the BitLocker Recovery Password Viewer under Add Features, Remote Server Administration Tools, Feature Administration Tools, BitLocker OK, after that the BitLocker tab showed up but nothing had been backed up If you miss requiring backup to AD when you first enable BitLocker it will never happen unless you explicitly tell Windows to with manage-bde So after LOTS of horsing around with manage-bde and figuring out all the really bad documentation errors on Technet and in the command line help I figured out I had to run manage-bde -protectors -adbackup C -ID GUID To figure out the GUID I had to run manage-bde -protectors -get c Now, the BitLocker tab on this computer's account in AD properly shows the recovery password and it's ID http://www.secuobs.com/revue/news/348501.shtmlhttp://www.secuobs.com/revue/news/348501.shtml Secuobs.com : 2011-12-19 15:15:57 - Security et al - I ve been noticing a lot hype about security risks with the rise of virtualization and much of it vague and short on specifics Also much of it seems to assume all the security we ve built up on a physical server goes out the window when you migrate to being a virtual machine And that s just not true A virtual server is the SAME server it was before it was P2V d from a physical server The same authentication, access control, audit, network controls are active as they were before The virtual server sits on hosts and SANs in the same datacenter as the physical server did before So what has changed What are the new risks It s in the virtualization infrastructure layer Given the ubiquity of VMWare and my personal knowledge of that solution I m going to use it to give various virtualization components real world names How secure is the host, the storage and the host control server In VMWare terms I mean how secure are the ESX ESXi hosts, the SANS and the vCenter servers That is the real question here Now that we ve inserted a new layer between the guest OS and the hardware that layer s immediate components and other components they depend on the Active Directory forest that the vCenter servers belong to need the same security controls anything else on the work needs Virtualization security is even more critical in some respects because someone who compromises that layer has low level access equivalent to physical access to every guest server and its data I have observed in recent audits that some areas of security and control of virtualization components is immature and does reflect consciousness how critical the virtualization layer is to security Before I dive into those areas let s first talk about network security In the hype I referred to in the introduction, much is made about network security risks associated with virtualization and I m not really seeing that Most servers are not behind internal firewalls or on heavily restricted network segments in the first place so moving them to an ESX i host on a virtual switch doesn t expose the server to new network risks For servers that had such controls when they were physical, you can set up the very same thing with virtual switches and firewalls If you need to mix external facing and internal VMs on a host you can set up completely different virtual switches and that s what I IT shops doing There are more advanced attack scenarios involving a compromised VM where the attacker breaks out of that VM and into the host and possibly back up into other VMs but right now that is one area where we are ahead of the bad guys in the arms race That is something to stay vigilant about though The other area of network security is the protection of the visualization infrastructure itself Unless IT shops totally ignore virtualization best practices they are going to implement multiple network cards on ESX i hosts that allow you to completely separate guest, live migration aka vMotion , storage and management connections from VMWare vCenter and clients to the host traffic In the audits I ve performed, SANs and the management interfaces on hosts are isolated from rest of the organization s internal LAN This brings me to the areas of virtualization where I have found serious risks privileged access, Active Directory and auditing First privileged access Anyone reading this knows that allowing administrators especially multiple administrators use the built-in root or admin account on operating system is bad practice and risky for all sorts of reasons Everyone should have their own account The same goes for virtualization hosts only more so However in my audits I ve observed many hosts being managed by the built-in root account shared among multiple administrators With a virtualization host, the risk of shared and insecure root accounts is multiplied by number and criticality of all the guest VMs on that host There s no good reason for this bad practice and there s no need to create additional root accounts on hosts for each admin either That s because best practice is to lock down ESX i hosts so that even admins don t directly access them and instead go through the central management server called vCenter in the case of the VMWare environment vCenter doesn t share the same prevalence of insecure root access because vCenter integrates with Active Directory and allows you to leverage the AD accounts admins already have If for some reason a shop can t follow that important best practice of avoiding direct access to hosts then you can configure the hosts themselves to integrate with Active Directory Speaking of Active Directory, I ve uncovered another prevalent risk associated with the dependence of virtualization infrastructures on AD Let me be clear that I think directory integration and unified authentication is definitely the way to go but here are some risk factors people have been missing First there s the fact that I often find virtualization management servers like vCenter to be members of the main AD forest Here s what that means A Windows server belonging to a domain is exposed to any all risks in Active Directory and all domain controllers within that forest remember the security boundary in AD is the forest not the domain Building on that, a vCenter server is the boss of all the ESX i hosts connected to it Ergo, everyone who has domain admin authority anywhere in the AD forest and anyone who compromises a domain controller in the AD forest can take the vCenter server and from there compromise the virtualization infrastructure and ultimately any guest VM and its data A point I have to make, sometimes to the chagrin of some folks in IT, is that any outstanding risks from previous AD audits must be carried forward to the virtualization infrastructure audit too For instance, at one bank, there was a problem of a very excessive number of IT folks having domain admin authority to the main AD forest That was problem enough as a risk to AD and the Windows systems within that forest But with the virtualization management server as a member of that forest, now every virtual machine even those running Linux and Windows servers in other forests are now accessible to that same excessively large group of AD admins Worse, in this organization remote access was widely available with no strong authentication So the entire virtualization infrastructure and countless servers running on it were vulnerable to compromise by a successful password based attack against any one of many AD admins The solution First, think about the AD forest s that hold either your virtualization management servers eg vCenter or those user accounts with privileged access to the virtualization infrastructure ie users with the Administrator role in vCenter Those forests, including each domain and domain controller within them, must be locked down and secure to a level appropriate for the virtualization infrastructure itself There s no avoiding that Organizations with outstanding AD security issues with no resolution in site should really look at implementing a small, separate AD forest for providing directory and authentication services to their infrastructure including virtualization, storage and network components This small AD forest would be much more locked down and protected and careful thought should be given before implementing synchronization or trust relationships between it and other forests This may be at the price of maintaining additional user accounts for infrastructure admins but that is the price of security in this instance If trust is implemented it should such that the infrastructure forest is trusted by the other forests not vice versa If synchronization is implemented, password changes or other authentication data should not flow from other forests or directories into the infrastructure forest The final risk area I ve observed with newly virtualized organizations is a lack of auditing and log management for virtualization infrastructure components And in this case there s no easy solution Virtualization management servers eg vCenter and hosts eg ESX i can generate audit logs and it is crucial to enable this feature and subsequently collect, archive alert and report on this log data the same as is necessary with any other security critical components on your network Virtualization hosts like ESX i are simple to accommodate since they can send events via syslog But management servers like vCenter are more problematic vCenter creates a number of text log files named vpxd-1 through 9 but my research has proven them to omit very important data and fail to resolve other key ID codes That s not to say the audit trails aren t there They are but they are trapped inside database tables In the case of vCenter the audit trail is stored in VPX_EVENT and VPX_EVENT_ARG tables within the vCenter SQL database Incomprehensibly command line interfaces like Get-VIEvent that pull data from these leave out critical event arguments as well as the name or ID of the event itself So the final option seems to be direct query of the SQL tables themselves with the necessary resolution of foreign keys to rows in related tables This presents an opportunity to log management and SIEM vendors to distinguish themselves with enhanced support for collecting enriched audit trails from virtualization infrastructures So, are there risks in the typical virtualized data center Without a doubt But before rushing out and purchasing esoteric and immature virtualization security products it s important to cut through the hype and identify what the real risks are In the environments I ve seen the risk is less among the virtual machines and more with the basic security controls of the infrastructure itself as well as risks resulting from poorly understood security dependencies between the virtualization infrastructure and the directory used for identity and authentication Make sure virtualization infrastructure components are properly isolated Follow the same best practices for securing root access on hosts as we ve had to apply to normal servers for decades And include audits trails from virtualization infrastructure in your log management efforts http://www.secuobs.com/revue/news/347980.shtmlhttp://www.secuobs.com/revue/news/347980.shtml Secuobs.com : 2011-11-24 01:08:13 - Security et al - One of the next coming of age moments for audit log management is automating more of the review and response tasks associated with security events Right now we tend to expect log management SIEM solutions to scour logs, identity high-impact changes or other suspicious activity and simply alert someone It s up to that someone to assess the information, make inquiries or other research and ultimately resolve the matter Instead of creating more manual work for infosec staff and administrators wouldn t it be great if the system could carry out some of that review, inquiry and decision work on its own In this article I ll present several automation opportunities In addition to some simple integration with Active Directory or other LDAP services these scenarios would require a degree of scripting and workflow capabilities like those provided by SharePoint or similar technologies 1 Verifying New User Accounts The appearance of a new user account is an important event to the security of a system since it signifies a new way to gain entry to that system s resources Such new accounts need to be reviewed to prevent the unnoticed creation of backdoor accounts by intruders or simply insecure accounts created outside the change management and security controls of the organization But it is laborious for an infosecurity person or admin to wade through new user account notifications and potentially difficult for him or her to identify inappropriate accounts especially at larger organizations with greater turnover How could this process be automated Upon encountering a new user account eg event ID in Windows Server 2008 Active Directory log management solution would compare the new account s name to the naming convention standards for the organization Naming conventions at most organizations at least distinguish between human user accounts and system accounts created for services, applications and batch processes Often there are additional naming standards that make it easy to distinguish between variants like employees, contractors, privileged admin accounts Let s imagine Acme Corporation prefixes employees with e, contractors with c, admins with p and system accounts with s When our automated response rule encounters a new user account beginning with x it would recognize this as a non compliant user account and open a ticket with the team responsible for enforcing security standards On the other hand when seeing an account beginning with e, it would email the manager for the employee based on the direct reports or department attribute of the new employee account and ask the manager to attest to this account as corresponding to a new hire in his or her department Through many audits performed over the years I ve seen the value of ensuring that each user account can be tied to an employ record in the HR system so our automated response system may also look up the employee in the HR system ensure proper correlation there as well If it finds an exception an ticket would be opened with the same IT group responsible for security control compliance to track down where the disconnect occurred As you can see though the amount of manual intervention by IT or other departments is greatly reduced yet the amount of verification is much higher and more thorough than normally possible Some organizations may be able to take the automation even further by tying out new account provisioning to new hires in the HR system automatically Inquiries regarding new accounts indicated to be contractors might be routed to the appropriate contract management group in purchasing or to the Manager if that attribute for contractors is populated with the employee who is the main liaison for the contractor Such contractor accounts would also be checked to ensure that an expiration date was configured of not more than some defined maximum period such as 3 months If the quantity and turnover of contractors warrants it, the system could even look up the contractor in the contract management system to correlate the account and expiration date automatically If such correlation fails the system would assign a ticket for the with the appropriate IT group By insisting that every account possible be tied to an employee or other business object such as a contract it becomes much more difficult to purposefully sidestep security controls or for accounts to slip through the cracks 2 Verifying Group Membership Additions Second only to new user accounts in security importance is a member being added to a group which with very few exceptions indicates an expansion of access be granted to the new member Such events are likewise excellent opportunities for automated response The crucial element in automating new group member response is for our system to be able to identify the data owner responsible for approving entitlements to the data to which that group grants access Assuming our repository of groups is Active Directory, the obvious attribute is the Managed By property which allows you to specify a user account By populating each group s Managed By attribute with the appropriate data owner we make it easy for our automated response system to determine who to contact when new members are added In that email notification the data owner would be asked to confirm that he or she had in fact approved this new entitlement by clicking on an appropriate link A positive confirmation would close out the matter and document that re-verification had been performed A negative response would open a ticket with the information security group to investigate including all relevant information including the user shown by the audit log to have executed the group member addition These are the only cases that would require manual intervention by the information security team, yet each and every group member addition would be confirmed 3 Following Up On Suspicious Logon Activity One of the most difficult events to follow up on are failed logons due to a bad password since they are often caused by a user simply entering the password incorrectly These events also present a possible opportunity for automated response An information security analyst who had reason to suspect an attack on a given account would typically contact the user to determine if they were inadvertently the source of the audit events Likewise out automated response system upon observing failed logons may contact the user similar to the processed described above for group member additions Of course in most cases some threshold of logon failures should first be exceeded before contacting the user so that users don t become wearied by incessant inquires each time they mis-enter their password Or perhaps this automated response would only be implemented for privileged accounts with administrator or root access In any case consideration should be given to the method of communication used to contact the user Since email access may be controlled by the very account under attack it may be better to use an out of band communication such as sending a text message to the user s phone again illustrating the important of being able to leverage information from the organizations directory when responding to events IP Geolocation could be leveraged as well to help identify suspicious logon attempts When our system observes a logon attempt successful or failed from a country or region outside the normal area defined either for the organization as a whole or for the user individually if physical location data is stored with the user s directory information the system could send message to the user asking them to contact information security if they do not recognize the activity These are just 3 examples of security events for review and response could be automated Of course the ability to script such automated responses, access to the directory service, HR data, IT ticketing and some type of workflow system are important requirements but by careful analysis organizations can identity those operations which are important and or frequent enough for which such an investment would pay off Through such integration and automation you can accomplish increased vigilance while eliminating the manual effort required to follow up on the myriad security events generated every day at any organization http://www.secuobs.com/revue/news/342321.shtmlhttp://www.secuobs.com/revue/news/342321.shtml Secuobs.com : 2011-11-15 22:07:52 - Security et al - Introducing LOGbinder SQL - SQL Audit Policy Wizard Our totally free SQL Audit Policy Wizard steps you through the process of implementing SQL Server 2008 auditing You can use our recommended baseline audit policy or customize it to fit your requirements After selecting your SQL Server and fine tune your desired audit policy, SQL Audit Policy Wizard automatically creates the necessary Server Audit and Server Audit Specification objects on your SQL server and optionally enables them so that auditing begins automatically You can also see the actual Transact-SQL generated by the wizard for learning purposes or for further customization SQL Server 2008 Audit Policy Wizard even allows you to modify existing audit objects Get the wizard now, for free - no trialware expiration, etc http://www.secuobs.com/revue/news/340860.shtmlhttp://www.secuobs.com/revue/news/340860.shtml Secuobs.com : 2011-11-03 23:10:17 - Security et al - Much of the security and control of an enterprise IT environment rests on Active Directory It provides authentication and access control for Windows users and applications, as well as for UNIX, Linux and mainframes Even VPNs, extranets and internal network security technologies all use Active Directory for policy and identity information To comply with information security best practices and compliance requirements, Active Directory must be regularly monitored and audited However, if you've spent any time with the the native Windows security log you know that it provides only limited Active Directory audit capabilities Just one example is the fact that while the Windows security can tell you that a Group Policy Object was edited, it cannot tell you which of the nearly 1,000 settings were changed And don't get me started on the noisy events generated and important information not logged when you try to audit Windows file sytem access In this whitepaper sponsored by Quest Software I explore the gaps in native Windows auditing that prevent organizations from achieving full compliance with best practices and security requirements In fact I identity specific requirements in PCI, SOX and FISMA that make effective audit log management of Active Directory and the larger Windows environment mandatory Then I provide a brief tour of Quest's new On Demand Log Management and explain how this unique cloud based solution not only provides extremely easy to deploy core log management functions but also goes much further than typical log management solutions to bridge the gaps in native Windows auditing like the one described above involving group policy Read this whitepaper and learn Where are the serious gaps in native Windows auditing Which compliance requirements do these gaps prevent you from meeting How does Quest On Demand Log Management bridge these gaps by replacing certain native audit funcitons How can you deploy log management and achieve compliance with a fraciton of the effort required by traditional software Get the paper now Click Here http://www.secuobs.com/revue/news/338754.shtmlhttp://www.secuobs.com/revue/news/338754.shtml Secuobs.com : 2011-11-02 21:40:23 - Security et al - I'm excited to announce that my software company, LOGbinder, has just released LOGbinder SQL as beta If you need audit logging for SQL Server you will be interested to know about SQL Server 2008's new audit foundation and how LOGbinder SQL allows you to connect SQL's audit capability to your existing SIEM log management solution Introducing LOGbinder SQL SQL Server 2008 introduced a totally new audit logging facility, which is critical to enterprises storing sensitive information and or processing important transactions in today s demanding compliance environment SQL Server Audit is flexible in terms of audit policy and comprehensive in relation to the breadth and depth of objects and actions that can be audited However, the audit data generated by SQL Server needs additional refinement and processing before it can be relied up on as a usable audit trail and be managed by your existing log management SIEM solution The audit records generated by SQL Server audit are cryptic and difficult to understand Basically, one log record format is used for documenting everything from an insertion on a table to giving a user ownership rights to a database And while SQL Server can write events to the security log, it uses the same event ID for all events, and the IDs and keywords are not resolved Thus, it requires in-depth knowledge of the SQL audit model in order to decipher events Our LOGbinder SQL agent enriches SQL Server s cryptic and generic audit messages to produce easy-to-understand audit log events Similar to LOGbinder SP, these events can be outputted to the Security log a custom Windows event log, where any log management or SIEM solution can collect, alert, report, and analyze Here is an example of an event Raw Audit Event from SQL Server event_time 2010-09-16 12 35 300787755 sequence_number 1 action_id APRL succeeded true permission_bitmask 0 is_column_permission false session_id 54 server_principal_id 260 database_principal_id 1 target_server_principal_id 0 target_database_principal_id 0 object_id 7 class_type RL session_server_principal_name ACMESP Administrator server_principal_name ACMESP Administrator server_principal_sid 0 database_principal_name dbo target_server_principal_name ACMESP Administrator target_server_principal_sid 0 target_database_principal_name public server_instance_name SPDEV SQL08ENT database_name AuditTest schema_name object_name MyAudit statement EXEC sp_addrolemember N'MyAudit', N'public' additional_information file_name c sql audits AuditAll_12633920- FB34-4FAA-8F96-E9F8FED158A9_0_ 129276798828120000sqlaudit audit_file_offset 1536 Same Event After LOGbinder SQL Processing Event ID 24020 Add member to database role succeeded A principal was successfully added to a database role Action Group DATABASE_ROLE_MEMBER_CHANGE_GROUP Occurred 9 16 2010 12 35 300000000 PM Session ID 54 User ACMESP administrator Server SPDEV SQL08ENT Database AuditTest Member Name public Domain name n a Role ID 7 Name MyAudit Statement EXEC sp_addrolemember N'MyAudit', N'public' Learn more about LOGbinder SQL and download the beta today Click Here http://www.secuobs.com/revue/news/338445.shtmlhttp://www.secuobs.com/revue/news/338445.shtml Secuobs.com : 2011-10-19 16:02:13 - Security et al - Intrusion detection and compliance are often the focus of log management SIEM efforts and security logging in general But security logs when managed correctly are also the only control over rogue admins Why do I say that Well, once you give someone root or admin authority there is nothing they cannot do They can circumvent any access or authorization controls you implement on the system because with admin authority they can either directly change those settings or use hacker tools that leverage their root access to tamper with the internals of the operating system Beyond rogue internal admins, the same issues I bring up in this article apply to the risk of outside attackers who gain admin authority aka root access The only control you really have over privileged super users is an audit log that, if properly handled, can serve as a deterrent and possibly detective control against misuse of privileged authority But notice I say if properly handled Those 3 words serve as in important warning that simply enabling auditing and deploying a log management solution may not suffice to provide a solid deterrent to rogue admins To really be a deterrent, the audit log must be protected from deletion or tampering by rogue admins First and foremost that means you must move log data as frequently as possible from the system where it is generated to separate secure log repository Today s enterprise log management solutions do a great job of frequent log collection and long term archival However, who has privileged access to your log management solution and the systems on which it runs A log management process is not an effective control over administrators if those same administrators have privileged access to the log management components To be clear I m not suggesting that administrators be denied access to run reports, configure alerts or research logs I m talking about privileged access to the log management solution that allows someone to disable, erase or otherwise compromise the integrity of the log collection and archival process So, to reiterate a log management solution cannot serve as a deterrent over administrators if those same administrators have privileged access to it at the application level or any of the infrastructure components on which it runs That includes the operating system of the log management solution any database servers it uses the Active Directory forest in which the log manage server resides if a Windows server the NAS or SAN where it stores log data Moreover if the log management application or any of the components above run inside a virtual machine you should also include the virtualization host, such as VMWare ESX i , if it runs inside a virtual machine the virtualization manager, such as VMWare vCenter any of the components listed earlier which are used by or host the virtualization manager And of course physical access to any of those components would also potentially allow administrators to compromise the integrity of your audit trail Wow Does that mean your log management solution needs to run on a completely separate infrastructure To the extent possible, absolutely It certainly speaks to at least consider building your log management components from traditional physical servers and local disk storage And remember such separation is a protection against not just internal rogue admins but any outsider that succeeds in obtaining privileged access well Any outsider sophisticated enough to achieve that will also make efforts to erase their tracks Of course there are always cost benefit comparisons to be made Typically the larger the organization the more important and more practical it is to achieve maximum separation between the log management solution and the environment it monitors Beyond hardware and software separation, you must also consider who will provide the care and feeding for the log management application, database servers, storage, OS and other components Larger organizations have a dedicated information security team Within that team there should be a group with responsibility for the audit log management process For full accountability and separation of duty, that team should have no privileged access to production business systems monitored by the log management process Ideally that group would provide the care and feed necessary for all components in the log management solution Of course that may be impractical since information security professionals on that team may not be conversant in all the technologies involved In that case they should call upon the expertise of IT staff with the required skills as needed and ideally they would supervise the actions taken by such staff to ensure they do not compromise audit log integrity such as through the introduction of backdoors There are a host of reasons why even the supervised access method described above may not work Staff in smaller IT shops have to back each other up and often can t specialize so the possibility for separation of duty like that described above may not exist Or, there may be a dedicated security and compliance officer, but that person may not be technical enough to supervise IT staff when maintenance is required on log management components Finally in some organizations there may be great push back to carving out a separate physical hardware environment for audit log management When an in-house physically and logically separate log management system isn t possible organizations, log management as a service may be an interesting alternative With cloud-based log management the entire log management system is at another site under the control of a professional service team Furthermore, some services can be set up with role based access control so that the ability to erase audit logs is controlled If organizations can overcome the frequent pushback to shipping audit logs to the cloud, full isolation and integrity of log data can be achieved without building a separate log management system and without needing system care and feeding expertise within the team responsible for audit log management Whether an organization goes with an in-house audit log management or turns the cloud it should carefully assess whether its choices in architecture and administrative responsibility allow it to rely on the log management system as a deterrent detective control over rogue admins and as a means of impact analysis and recourse against outside intruders who gain root access When the worst happens, audit logs may be all you have Are they secure http://www.secuobs.com/revue/news/335712.shtmlhttp://www.secuobs.com/revue/news/335712.shtml Secuobs.com : 2011-09-22 23:46:29 - Security et al - Maybe Quiet Riot isn t your band OK, the song was originally a 1973 Slade hit but come on, I was only 3 but that line describes the Windows security log so well There s no getting around the fact that there are a lot of useless and inexplicable events in the Security log and the sooner you get comfortable with that the sooner you ll save your sanity and get on with work In this article I ll look at some common examples or noise events in the security and discuss strategies for dealing with them You need to recognize noise events for what they are for 2 reasons First the earlier in the log management process you can discard or ignore noise events the better for performance, bandwidth and storage Second, you can waste a lot time investigating seemingly suspicious events that are meaningless One example of high volume noise events are Kerberos service ticket renewal attempts generated on domain controllers Kerberos has 2 kinds of tickets authentication tickets aka ticket granting tickets and service tickets Authentication tickets see event IDs 4768, 4771 and 4772 on Windows 2008 and 627, 675 and 676 on Windows 2003 are connected with the actual authentication of the user or computer to the domain controller while service tickets vouch for that user s identity to the member computers the user subsequently accesses on the network When a user remains logged on or a computer remains up long enough the service tickets expire and Windows needs to renew them with the domain controller A successful service ticket event event ID 673 on Windows 2003 and 4769 on Windows 2008 is useful in that it provides a record of the workstation and servers a user accessed But a successful ticket renewal event ID 674 on Windows 2003 and 4770 on Windows 2008 denotes nothing of value other than the fact that the user or computer remained logged on or powered up for a long time If a user remains logged on or a computer remains up without being rebooted for extra-long, the service ticket reaches it renewal lifetime limit and the domain controller finally rejects the renewal request which generates a renewal failure There are other scenarios but at the end of day any kind of service ticket renewal successful or failure and any kind of service ticket request failure event is essentially noise There are some theoretical malicious situations where service ticket events could conceivably be generated but in practice they are very unlikely and there are no criteria you could use to distinguish those events from all the background noise of other service ticket events An example of a seemingly suspicious event that is really just noise is the sometimes frequent occurrences of event ID 537, Logon failure - The logon attempt failed for other reasons , where user name is blank I frequently hear from concerned admins who are worried they are under some kind of attack In this case look the sub status code in the event description and you will probably see 0xC0000133 The time at the primary domain controller is different from the time at the backup domain controller or member server by too large an amount No security issue here just a time sync problem on the initiating computer or the domain controller Dealing with the quantity and variety of events you encounter can be overwhelming but here s a strategy that will keep you on track and prevent you from wasting too much time on noise events First, identify what you know to be noise events like the examples described above Configure your log management SIEM solution to suppress or filter those events out from any alerts you receive or reports that you review on a regular basis Make sure you document your justification for filtering those events that is, why they are considered noise or unimportant Next set up alerts and reports for events you 1 know to exist and 2 consider important enough to generate an alert or show up in a report you review every day There may be other events that don t deserve any kind of response but which you want to keep around for compliance purposes If you aren t already archiving entire logs noise and all - make sure that your log management process results in these boring but necessary events being archived After those steps the only events left over are events you don t already know about and thus have not classified as noise, important or boring but necessary Whatever your log management processes and technology there should be a way to view any such unclassified events Periodically reviewing these events will prompt revisions to your criteria for the classification types described above with the eventual goal of no unclassified events This strategy ensures you don t indefinitely miss unknown but important events and provides a systematic way for managing noise While the Windows security log graciously logs all events from a finite set of IDs which I ve documented at wwwultimatewindowssecuritycom securitylog encyclopediaaspx, many other logs, like those from Linux and Unix, have no well-defined and bounded event schema The strategy described in this article is even more useful with such logs where you never know exactly what s going to be thrown your way And I can tell you that it works because it s one of the core concepts I use in my log management consulting projects and in my Rosetta Audit Logging Kits All things considered you have to get comfortable with noise events in your logs Through audit policy refinements you may be able to reduce some of the useless events written but there s no way to configure the noise completely out of your logs Windows audit policy just isn t granular or flexible enough even with the new subcategory audit policy structure released in Windows Server 2008 The same goes for other log sources So, identify what you want from the log and don t get too hung up on everything else The security log isn t like a financial audit trail where every transaction and penny can and should be justifiable There are some events in the security log you ll just never be able to run to earth but don t worry about it http://www.secuobs.com/revue/news/330488.shtmlhttp://www.secuobs.com/revue/news/330488.shtml Secuobs.com : 2011-08-22 00:22:55 - Security et al - Security standards and auditors make much of reviewing logs for malicious activity and I am constantly asked for event signatures indicative of intrusions or even more simplistically some ask What are the top Event IDs for intrusion detection Ah, if it was only that easy Movies make it look that way, the protagonist furiously defends the network while a computer voice stridently calls out intruder, intruder But in the real world, if the computer can detect an intruder it takes immediate preventive steps instead of simply logging the intrusion or helplessly calling out intruder For instance if an attacker tries to discover an account s password through repeated logon attempts, the system locks out the account On the other hand, if a disgruntled employee copies sensitive data to flash drive, to the operating system it looks like any other day of normal usage An authentic user accessing authorized data If the system is logging anything at all, there will just be an audit trail of successful access attempts It s not impossible to use logs to detect some intrusions and malicious activity but the first and foremost return on investment from logging is an audit trail that can be used to detect high impact changes in security stance, investigate incidents, perform impact analysis, take action against offenders and learn how to prevent repeat attacks in the future Moreover, a properly deployed audit system serves as an effective deterrent control against insider abuse All of this can be accomplished by enabling logging on monitored systems and implementing a log management solution with high integrity deployment characteristics But to get more than change detection and audit trail usage from your logs you must go upstream from the logging function and get the cooperation from system administrators to configure and operate systems in such a way that certain foreseeable types of malicious activity will recognizable to your log management solution Take security log integrity in Windows as a simple example Windows provides strong protection against tampering with the security log Unless the operating system is down and you have physical access to the system you basically have to be an administrator to erase the security log It s very difficult even with administrator authority to modify event records in the security log you need a program like the old WinZapper Windows graciously logs a specific event ID 517 on Win2003 and 1102 on Win2008 whenever the log is cleared so it makes sense to generate an alert whenever security logs are cleared as a deterrent to rogue administrators trying to cover their tracks or as a way of detecting an intruder doing the same But if your administrators are in the habit of clearing the log when diagnosing system problems, your alert rule will generate false positives Therefore, in addition to reactive log management you must proactively get administrators to comply with a policy to never clear security logs and allow old events to die a natural death as records are purged While the previous case demonstrated an example of procedural measures implemented upstream from the log management process, detecting the spread of file based malware requires you to work with system administrators to setup system objects ahead of time for the purpose of helping the log management solution distinguish between normal file access and malicious Here s the premise you want to detect malware that has made it through your preventive controls like antivirus Most malware either spreads by injecting itself into files of affected file types ie word documents or image files or looks for files that it can send back to its nefarious operator So, we set up the equivalent of a trip wire for unsuspecting malware or outside intruders to trigger In this example I ll stick with the Windows and Active Directory environment but the concepts would be applicable to other platforms To do this we work with various system administrators to create honeypot folders on servers throughout the network In these folders we put a collection of files with all the common file types including Office documents, image files eg JPG, GIF , PDFs and others that have been targeted by malware Ideally we name these honeypot folders with just one or a few easily recognizable folder names We grant everyone access to these folders and enable file system auditing so no matter what user is the victim, the malware will have access to folder in order to trigger the tripwire If we want to detect malware that is spreading itself or simply corrupting data, we limit file system auditing to WriteData and AppendData On the other hand if we also hope to detect malware that is stealing data we would also enable auditing of ReadData Then back at our log management solution we would enable alert rules when file system audit events event ID 560 on Windows 2003 and 4663 on Windows 2008 arrive which identify one of our honeypot folders as having activity To prevent false positives some training and reminders may be necessary for end-users so that they understand these folders especially those on file server shares have nothing useful for them and are there for system purposes These 2 examples demonstrate you can take a foreseeable type of malicious activity and implement procedures or system objects that make it possible to detect activity that would normally blend in with the background noise of everyday, legitimate usage The downside of course is that you require cooperation from folks who are upstream from the log management solution Depending on the capabilities of your log management solution, you may be able to discover malicious activity without implementing upstream tripwires using a final method anomalous changes in activity levels Some types of malicious activity cause a spike in audit events that can be detected if your log management solution has sufficient real-time analysis capabilities My favorite example is the disgruntled insider who intends to post thousands of documents to a site like Wikileaks The user likely already has access to the sensitive documents in question so there may be little or no failed access attempts to alert you to what is happening Instead, file system auditing, if enabled, will generate successful read attempt events for each file accessed However, if a typical day in the life of the angry employ involves accessing just a handful of documents and now he or she suddenly accesses many times that amount, a feature rich log management solution should be able to keep a rolling average of normal Read events on sensitive folders for each user and detect a spike like this At that point there is sufficient cause to generate and alert and devote some security staff time to determining the cause With anomalous activity level detection, some thresholds can be generalized and baked into the log management solution but others would need at least some amount of customization by the organization such defining folders or servers that are considered sensitive As you can see, detecting intrusions and abuse with logs is possible but it requires a variety of analysis techniques Likely you will need the cooperation of system administrators upstream from your log management system in order to setup procedural or system level tripwires Finally your log management solution s ability to analyze large amounts of data detect sudden changes in activity levels for a given system or user can be very effective in alerting you that something is afoot http://www.secuobs.com/revue/news/324343.shtmlhttp://www.secuobs.com/revue/news/324343.shtml Secuobs.com : 2011-08-02 21:30:33 - Security et al - Just a quick note about a what looks like a pretty bad backdoor to Windows 7's AppLocker and the older Software Restriction Policies I've just learned about it and will be covering it in greater detail in tomorrow's webinar It's a backdoor created by Microsoft for when you load a DLL Just specify the LOAD_IGNORE_CODE_AUTHZ_LEVEL and AppLocker ignores the DLL Furthermore there's a similar flag, SANDBOX_INERT, on the CreateRestrictedToken api that allows you to apparently start a new process with AppLocker disabled as well Again, I'll have more on this in tomorrow's webinar http://www.secuobs.com/revue/news/320637.shtmlhttp://www.secuobs.com/revue/news/320637.shtml Secuobs.com : 2011-07-08 14:24:00 - Security et al - Vista, Windows 7 and Windows Server 2008 generate a lot of events regarding the Windows Firewall and for most of us in most scenarios this is at best chatter if not down right noise Here's how to get rid of it You need to disable all of the audit subcategories that reference Filtering Platform or MPSSVC as well as the Other Policy Change Events and other System Events subcateogory Thats Other Policy Change Events Other System Events MPSSVC Rule-Level Policy Change Filtering Platform Policy Change Filtering Platform Packet Drop Filtering Platform Connection That's what I do in my Recommended Audit Baseline If you are on Windows Server 2008 R2 you can use group policy instead of the auditpol command look for the Advanced Audit Policy folder at the bottom of Security Settings Don't forget to enable this policy before you start configuring subcategories Related webinars Configuring Windows Audit Policy to Minimize Noise Provide Compliance, Support Forensics and Detect Intrusions 7 Ways to Reduce the Noise in the Windows Security Log http://www.secuobs.com/revue/news/315835.shtmlhttp://www.secuobs.com/revue/news/315835.shtml Secuobs.com : 2011-06-24 19:29:15 - Security et al - I love Tilana's Continuous Data Protection - it's awesome and now they support running on 64 bit workstations Beyond efficiently backing up files as soon as they change or are created, Tilana also syncs folders between multiple computers - works awesome Plus you can share files with non Tilana users - a great way to send large files instead of by email attachment Tilana just creates a unique URL that you send to anyone You can have access expire after so many downloads or after a specified number of days wwwtilanacom http://www.secuobs.com/revue/news/313436.shtmlhttp://www.secuobs.com/revue/news/313436.shtml Secuobs.com : 2011-06-24 19:29:15 - Security et al - Wow I just got off the phone with a prospective customer helping them to determine if out LOGbinder SP product would integrate with their SIEM solution it did and does with all SIEM solutions During the call they told me something I found very surprising After verifying that LOGbinder SP can purge old SharePoint audit events they said that every SIEM provider they speak to tells them that it s not the job of the SIEM solution to delete old logs it their job as part of operations The customer s beef with that response is that it causes them extra work to delete voluminous logs Well I agree that SIEM solutions should be able to delete old logs but for a very different and much more important reason Here s the theorem 1 Security logs should not be left on the system where generated This is infosecurity best practice 101 You need to get logs off the systems where they are generated and into a separate, secure archive Why Log integrity 1 If a bad guy breaks in to your system the first thing he ll do is delete your logs to cover up his tracks 2 Logs are the only control over administrators but if your official copy of logs are left on the system they administer they can tamper with the logs that are supposed to provide accountability over them Ergo Logs need to be collected 2 Logs eventually need to be cleaned up on the system where they are generated Some logs automatically wrap like the Windows event log for instance but some applications logs grow and grow like the IIS for instance These logs can soon consume gigabytes of space 3 Logs should not be deleted before they have been collected or else you lose valuable audit events and the integrity of your audit trail Ergo If logs need to be collected, need to be deleted from local systems but should not be deleted before being collected then who is the in the best position to do that The SIEM solution, right http://www.secuobs.com/revue/news/313435.shtmlhttp://www.secuobs.com/revue/news/313435.shtml Secuobs.com : 2011-06-23 01:59:21 - Security et al - SharePoint audit policy is widely regarded as a site collection level setting leading many to believe you must apply one audit policy to all objects in the entire site collection If that were the case you would run into some real granularity problems leading to either not being able to get the events you need for important lists or libraries or else enabling too much auditing and getting way to many events Thankfully though you can enable auditing on specific document libraries or lists but you have to know where to look which I will explain in a moment First though what audit policies would you likely want to enable for an entire site collection and what would you want to activate only on specific lists and libraries The one audit policy I always suggest enabling Editing users and permissions aka Security Change in LOGbinder SP which will provide an audit trail of all auditable security related changes for the site collection including permission changes, changes to users and groups and change to audit policy itself At the list and library level you have a variety of activities you that you can audit including Viewing Editing Deletion Check in Check out List library level audit policy is extremely important when it comes to auditing who is viewing confidential information If you enable View auditing at the site collection level you end up generating events for every page click by every user througout the entire site collection which will create a load on resources and storage To enable auditing for a certain library access the library s or list s settings page and click the Information management policy settings link under Permissions and Management In the next page you ll see entries for the content types allowed for that list or library For instance a normal document library will have 2 content types Document and Folder Click on a content type and configure auditing In the example below I ve enabled auditing of any type of view and download access since this is a library contains confidential information Now SharePoint will obediently begin auditing those actions on that particular list or library and if you have my LOGbinder SP software you'll be able to report or alert on those events with LOGbinder SP SIEM Edition or if you have your own log management SIEM solution you can use LOGbinder SP Agent Edition to get SharePoint audit events out of the content database where they don't belong and into your log management solution where they do Click here for more information on LOGbinder SP http://www.secuobs.com/revue/news/312995.shtmlhttp://www.secuobs.com/revue/news/312995.shtml Secuobs.com : 2011-06-08 19:58:35 - Security et al - I was just reading about the CEO of Lieberman Software and his rant about RSA SecurID Talk about kicking them when they're down He reportedly accuses RSA of letting SecurID languish I don't know if RSA has done that or not But what I do know is that anyone can get hacked RSA, Lieberman Software, you name it So instead of just switching to different strong authentication provider smart organizations are going to look for a strategic way to protect themselves against any of their vendors who might get hacked - especially their authentication vendors You should be able to plug and play mix and match tokens and other strong authentication methods without ripping out your infrastructure, without implementing multiple proprietary authentication servers You should be able to use the right token method for each unique situation in your organization and you should be able to phase out a vendor that gets hacked without major disruption to your users and network That's not pie in the sky This is all possible when you leverage the OATH framework and select authentication vendors that embrace and support OATH standards I just did a webinar on OATH and its relevance to this whole SecurID situation The recording is at Quest Software who sponsored the webinar They were the right sponsor as you will see when then demontrate their Defender solution which is the best implementation of the whole OATH concept that I've seen To watch the webinar click here http://www.secuobs.com/revue/news/309990.shtmlhttp://www.secuobs.com/revue/news/309990.shtml Secuobs.com : 2011-06-07 16:05:35 - Security et al - Endpoint malware is getting more and more sophisticated and more and more vendors and content file types are being targeted The signature based model of classic antivirus AV and the teams and infrastructure behind it are increasingly stretched to keep up with the pace and sophistication of today s financially motivated malware developers On the other hand patch management is getting more complicated as the bad guys target more and more software vendors Moreover both patch management and AV are reactive not proactive A fundamentally different approach to combating end-point malware is application whitelisting Not only is application whitelisting proactive but in contrast to the negative security model used by AV and patch management, whitelisting uses a positive security model to stop malware Traditional approaches to application whitelisting can prove to be maintenance nightmares, impact productivity and cause dissatisfaction among end-users But these challenges can be overcome by an advanced implementation of whitelisting that incorporates more intelligence into trust decisions and that addresses the realities of PC environments These thoughts are prompted by the fact that I just completed a whitepaper for Lumension entitled Using Defense-in-Depth to Combat Endpoint Malware A Technical Paper While researching for this paper I was impressed with the grasp of the issues that Lumension s team has on endpoint security and the challenges associated with whitelisting Whitelisting is a challenge because it s tougher than you might think to define what software should be allowed to run throughout your network Lumension s Intelligent Whitelisting takes the concept of a static application whitelist and applies it to the real world of hundreds or thousands of unique, ever changing PCs with a practical approach that provides immediate whitelisting benefits to any population of PC without the upfront burden of analysis and testing necessary with traditional whitelisting They do this by 1 Acknowledging the uniqueness of each PC by implementing an automatically customized local whitelist on each computer 2 Recognizing trusted agents of change so that patches, enhancements and new applications can be installed without any manual effort required to update whitelist rules 3 Allowing you to take a more practical, value driven approach by implementing whitelisting progressively rather than as a point-in-time, do-do-die cutover With endpoint malware more dangerous than ever, patch management and AV remain indispensable defenses but are insufficient by themselves due to their reactive nature and negative security model Application whitelisting provides the vital 3rd layer of proactive, positive security model defense Please request my whitepaper which expands on these issues in much more depth Click here to get Using Defense-in-Depth to Combat Endpoint Malware A Technical Paper http://www.secuobs.com/revue/news/309642.shtmlhttp://www.secuobs.com/revue/news/309642.shtml Secuobs.com : 2011-01-11 22:51:24 - Security et al - I am excited to announce that my first On Demand, Interactive course Audit and Assessment of Active Directory is now finished and ready for the first trainees And you have an opportunity to get this training for free if you agree to keep record of how many hours it takes you to complete the course This is the on demand, interactive version of the course I ve used to help IT auditors learn how to audit AD since AD first came out in 2000 Of course I ve updated the course many times to keep up with AD over the years For more information on Audit and Assessment of Active Directory visit http wwwultimatewindowssecuritycom itaudit training aaad defaultaspx My On Demand, Interactive OI courses are much more than a mind numbing web based training course They are the very next best thing to in-person training in the same room Best of Both Worlds - Randy's On-Demand Interactive courses provide the same content as the in-person course without the hassle and expense of travel No Passive DVD Viewing Experience - More than a long, passive DVD viewing experience, On-Demand Interactive are highly interactive training courses designed to closely duplicate the live, instructor-led learning experience Same as Live Training - Get the same printed courseware - Watch Randy teach the same material - Perform the same hands-on exercises - If you get stuck, watch Randy perform the exercise - Got a question Ask Randy via the Q A forum For more information on my On Demand Interactive courses visit http wwwultimatewindowssecuritycom training oioverviewaspx There s one more step in the course development process before I open AAAD-OI for general availability I need a few of you to take the course for free and keep track of your hours Then I will average those hours and to come up with the number of continuing professional education hours the course provides This is required in order for the course to qualify as CPE credits for your various certifications If you volunteer and are subsequently chosen to take the course and record your time spent in training we won t charge you That s right you ll get the training for free If you volunteer but aren t chosen there is no obligation but I ll send you a discount coupon code as our way of saying thanks for making yourself available To volunteer fill out this 9 question survey here http wwwsurveymonkeycom s 5NQC3L3 Remember, there s no obligation with filling out the survey except to take the course for free if chosen If you aren t chosen we will still send you a discount coupon code as our thanks Please volunteer now for your chance to get this high quality training for free Visit http wwwsurveymonkeycom s 5NQC3L3 http://www.secuobs.com/revue/news/277498.shtmlhttp://www.secuobs.com/revue/news/277498.shtml Secuobs.com : 2010-11-04 22:58:50 - Security et al - Patch management is changing fast Tomorrow's post at this page will discuss what's changing and the new risks and challenges that arise http://www.secuobs.com/revue/news/262544.shtmlhttp://www.secuobs.com/revue/news/262544.shtml Secuobs.com : 2010-10-01 21:09:12 - Security et al - Sometimes I wonder and today I wonder even more I've been a Microsoft MVP for years and I just got the email you see below Of course they don't really explain Last year I did everything I have in the past and more - yet they say the MVP Desktop Experience group is ever more competitive When I pointed out I'm actually in the Enterprise Security group, he said sorry, that one is too Are you aware of a lot of other techies specializing in the Windows security log to make it more competitive Do you think I should be kinder in my remarks about Microsoft Is it a matter of hurt feelings or something Anyway, bummer for me and you my community because the MVP benefits helped me get access to information I need to help you understand the Windows Security Log and other Microsoft security technologies If you like, visit http mvpsupportmicrosoftcom gp mvpnominate and lend me a helping hand -------------------------------------------------------------------- From -------------------------- Sent Friday, October 01, 2010 9 56 AM To Randy Franklin Smith Subject MVP Communication October 2010 MVP Award decision Dear Randy, Thank you for your participation in the Microsoft MVP Award Program for the year of 2009 As your MVP Lead, I have enjoyed working with you and appreciate your contributions to the Enterprise Security community, our product team, and our customers The MVP Award is presented to individuals for their past year s contributions to online and offline communities, which stand out from others in the communities that focus on Microsoft technologies Your contributions were diligently evaluated over the past year against the contributions of others in the Enterprise Security community As a result of this evaluation, you were not awarded as a Microsoft MVP for the October 2010 award cycle While we are unable to award you MVP status at this point in time, I hope to keep in touch with you for future MVP award consideration Microsoft currently awards on a quarterly cycle and you are eligible to be nominated for the Microsoft MVP award again in the future We greatly value your past accomplishments, contributions, and support The MVP program would be happy to reconsider you as an MVP candidate in the future and we hope to see you again Please always consider me a contact at Microsoft http://www.secuobs.com/revue/news/253602.shtmlhttp://www.secuobs.com/revue/news/253602.shtml Secuobs.com : 2010-07-08 03:29:07 - Security et al - My new Rosetta Audit Logging Kits take the guess work out of monitoring security logs and meeting compliance requirements Learn more here http://www.secuobs.com/revue/news/238540.shtmlhttp://www.secuobs.com/revue/news/238540.shtml Secuobs.com : 2010-06-18 14:39:04 - Security et al - Quest Software's Kirk Munro and I got together and solved 3 security headaches with this new PowerGUI PowerPack And did I mention it's free http wwwultimatewindowssecuritycom tools wspowerpack http://www.secuobs.com/revue/news/232843.shtmlhttp://www.secuobs.com/revue/news/232843.shtml Secuobs.com : 2010-05-13 23:53:47 - Security et al - When are they going to make a few fundamental improvements like being able to run multiple processes at the same time so that you can produce in the background while editing another video I'm getting tired of being loyal to software products, buying each upgrade, when only cosmetic or peripheral improvements are made I don't care about being able to automatically post my produced video online I want better functionality in the core editing http://www.secuobs.com/revue/news/221966.shtmlhttp://www.secuobs.com/revue/news/221966.shtml Secuobs.com : 2010-05-13 23:53:47 - Security et al - I love Tilana's Continuous Data Protection - it's awesome but when are they going to support running on 64 bit workstations Tilana is the only application holding me back from going 64 bit Windows 7 and being able to use more RAM http://www.secuobs.com/revue/news/221965.shtmlhttp://www.secuobs.com/revue/news/221965.shtml Secuobs.com : 2010-02-09 17:38:38 - Security et al - As more and more information and processes move to SharePoint, it becomes critical for compliance and security requirements to monitor and audit SharePoint activity I was very excited when I first learned about the SharePoint audit log but I quickly determined that in its unimproved state the SharePoint audit log is essentially unusable due to 4 key issues 1 SharePoint's audit log does not provide the names of users or objects The SharePoint audit log fails to translate record IDs, meaning you have no idea what object or user to which a given event refers Click here for an example of an audit event from SharePoint and then what LOGbinder does with it 2 SharePoint's audit log is buried in SharePoint's SQL server content database To ensure the integrity of audit trails, logs must be moved from the system where they are generated to separate and security log archive However in SharePoint, the audit log isn't really a log - it's a table in the SharePoint database This makes it inaccessible for most log management solutions Without the ability to collect the SharePoint audit log into a separate, secure log archive its value as a high integrity audit trail is compromised 3 SharePoint's audit log has no reporting In Windows Sharepoint Services the log is totally inaccessible and in Office Sharepoint Services it's exposed through through a few rudimentary, impractical reports in Excel 4 Windows SharePoint Services provides no interface for enabling auditing at all The audit log is there but without custom programming there's no way to turn it on much less access the logs I'm still a software developer at heart and the problems with the SharePoint audit log finally pushed me over the edge The result is LOGbinder SP LOGbinder SP is a small, efficient Windows service that monitors the internal SharePoint audit log without making any changes to your SharePoint installation For each event LOGbinder SP resolves the user and object IDs and other cryptic codes, producing an easy to understand, plain-English translation of the SharePoint audit event LOGbinder SP then sends these events to the Windows event log either the Security log or a custom log which in turn allows you to leverage any log management solution to collect, monitor, alert, analyze, report and archive SharePoint audit logs Here's an example event from the SharePoint audit log pictured as delivered via Excel compared to what the event looks like after LOGbinder SP translates it LOGbinder SP turns this SharePoint Audit Log Example LOGbinder SP is now out of beta and ready for prime-time You can download an evaluation copy, watch a webinar on the SharePoint audit log, get your questions answered and more at wwwlogbindercom Please try it out and tell me what you think http://www.secuobs.com/revue/news/190069.shtmlhttp://www.secuobs.com/revue/news/190069.shtml Secuobs.com : 2010-01-12 19:34:04 - Security et al - With 2008, SQL Server finally has a real audit log capability It s flexible, high performance and can report its events directly to the Windows Security Event Log which means you can leverage the security and integrity of the security log AND take advantage of whatever log management solution you currently use to collect, monitor and report server logs Now you can audit changes to SQL server configuration and objects as well as commands executed against tables such as Select, Update, Delete and Insert SQL Server 2008 auditing produces an audit log not a transaction log That means you can audit any command and or other action in SQL Server but the audit log does not record before and after images of the actual data table rows Again, it s an audit log not a transaction log Similar to Windows auditing, SQL Server 2008 auditing allows you to define which SQL server objects and actions you which to audit and you can limit audited activity to specific users or roles When you enable auditing you can choose to send audit events to either binary SQL audit log files in a specified folder or to the Application or Security event logs For obvious security and log management reasons I recommend the security log I wish Microsoft had used different event IDs for each audit event but all SQL Server audit events show up as event ID 33205 so that means you have to look in the event details for any and all particulars about the event The new SQL commands for auditing include CREATE SERVER AUDIT CREATE SERVER AUDIT SPECIFICATION CREATE DATABASE AUDIT SPECIFICATION In this real training webinar I will explain those commands and show you how to setup SQL Server auditing to report events to the Security log Then I will demonstrate a number of audit scenarios for tracking things like Permission changes Login and role changes Login failures Commands against specific tables like SELECT and UPDATE This real training webinar is not free For specialized topics where finding a sponsor is not practical I m trying out a new paid model The fee is low and there is no sponsor presentation your information will not be shared with anyone It s all deep, technical training To register please click here http://www.secuobs.com/revue/news/180757.shtmlhttp://www.secuobs.com/revue/news/180757.shtml Secuobs.com : 2009-12-28 21:28:32 - Security et al - The venue has been announced for my upcoming SLS class in LA Please click here for more details on the event http wwwultimatewindowssecuritycom blog defaultaspx p 137e4ecb-adb6-4c5e-806a-f87e99ad2944 http://www.secuobs.com/revue/news/176221.shtmlhttp://www.secuobs.com/revue/news/176221.shtml Secuobs.com : 2009-12-03 17:50:32 - Security et al - Password Management Top Ways to Deal with the Necessary Evil - http wwwultimatewindowssecuritycom webinars registeraspx id 79 http://www.secuobs.com/revue/news/168290.shtmlhttp://www.secuobs.com/revue/news/168290.shtml Secuobs.com : 2009-11-03 14:17:30 - Security et al - The customSD registry value doesn't work on Windows Server 2008 Instead you must use the wevtutil command See my updated article at http wwwultimatewindowssecuritycom wiki WindowsSecuritySettings Manage-auditing-and-security-log http://www.secuobs.com/revue/news/156678.shtmlhttp://www.secuobs.com/revue/news/156678.shtml Secuobs.com : 2009-10-06 20:42:46 - Security et al - I can't believe this Well, it's Microsoft, so yes I can believe it Where did the the Replace auditing entries on all child objects go in Active Directory Users and Computers While doing some consulting for a company I just noticed that in my this check box is not present on the Auditing tab of the security settings dialog for objects in Active Directory Users and Computers That makes it impossible to manage auditing of AD objects using the Directory Service category of the security log Has anyone else noticed this Any solutions I'm looking at writing a script to do it but for crying out loud, you shouldn't have to http://www.secuobs.com/revue/news/147972.shtmlhttp://www.secuobs.com/revue/news/147972.shtml Secuobs.com : 2009-09-24 20:42:22 - Security et al - I am very excited today to announce the beta release of LOGbinder SP - my first software solution aimed at expanding the reach of log management LOGbinder SP allows you to audit security events in SharePoint with the Windows Security Log Why do I need LOGbinder SP Doesn't SharePoint already have an audit log LOGBinder SP is a small, efficient NET service that monitors the internal SharePoint audit log For each event LOGbinder SP resolves the user and object IDs and other cryptic codes, producing an easy to understand, plain-English translation of the SharePoint security event Click here for a list of events Then LOGbinder SP forwards the event to one or more output formats local Windows security event log custom Windows event log syslog server text file XML file SQL server reporting database This variety of output formats allows you to extend any log management solution to now support SharePoint audit trails and security events Alternatively, or in addition to integrating with your log management solution, you configure LOGbinder SP to send events to a SQL Server reporting databse and use our pre-built reports implemented in SQL Reporting Services to review and analyze the security activity of your SharePoint sites LOGbinder SP is currently in beta and available as a free download Please help us build LOGbinder SP into a great solution Please visit http wwwlogbindercom sp defaultaspx to learn more about the SharePoint audit log and it's woeful limitations and how we fix them with LOGbinder SP Please download and put LOGBinderSP to work for you, securing SharePoint data not yet implemented in the current beta http://www.secuobs.com/revue/news/144122.shtmlhttp://www.secuobs.com/revue/news/144122.shtml Secuobs.com : 2009-09-21 19:39:09 - Security et al - Many of you have expressed interest in my Security Log Secrets in-person training if I ever scheduled a seminar at a public venue and date Choosing the right date and venue makes all the difference in getting enough attendees in order to run the course My recent survey indicated that first quarter of 2010 in Los Angeles was overwhelmingly the best venue and date DC you were a close second so I'll be looking at you next This special public training seminar of my Security Log Secrets course will be held in Los Angeles, January 25-27, 2010 Recommended hotel information forthcoming To register and for pricing click here This will be a unique opportunity for fellow security log nerds to gather in person and plumb the depths of the cryptic but vital Windows security log For complete information on my Security Log Secrets course click here or see the attached PDF at the end of this post I wish I could come to each of your cities but it just isn't feasible However, if you can't travel to LA, let me know if you would be interested in attending virtually Remember that it would be on Pacific time Terms No refund for cancellation within 30 days of event Don't purchase unrefundable airfare until we send you final confirmation Please register now Course Outline - Security Log Secretspdf 11 KB http://www.secuobs.com/revue/news/142894.shtmlhttp://www.secuobs.com/revue/news/142894.shtml Secuobs.com : 2009-09-16 02:37:18 - Security et al - I m very impressed with the Active Directory integration found in LogRhythm 50 This represents a new frontier in log management maturity The new AD integration in LogRhythm 50 allows you to combine information from Active Directory with key security log events to take your monitoring and response procedures to the next level of intelligent filtering and automated incident response This kind of capability is important because you need to constantly look for ways to reduce the number of alerts and report pages that you have to review and respond to by either automating the response itself or doing a better job of qualifying events that are actually inconsequential that is expected activity At the same time you need to constantly improve your monitoring procedures to quickly identity and respond to those events that truly are relevant With LogRhythm 50 you can add monitoring criteria, for instance, that take the user who triggered a given event and then look up that user in AD and check to see if he she belongs to a specified group Based on their membership, you can discard the event or trigger an alarm LogRhythm 50 also allows you to enrich reports with information from Active Directory Usually the only information about a user or group in a given log record is the object s name which makes it difficult to contextualize the event But being able to pull additional properties for that user or group from AD saves you lots of time and greatly improves your analytical capabilities If you d like to get more ideas for how you can integrate log data with Active Directory information for more sophisticated and automated monitoring and forensic analysis and if you d like to see LogRhythm 50 s AD integration features demonstrated check out my on demand webinar 5 Cutting Edge Response Techniques that Integrate Security Events with Active Directory http://www.secuobs.com/revue/news/141302.shtmlhttp://www.secuobs.com/revue/news/141302.shtml Secuobs.com : 2009-09-15 21:45:35 - Security et al - Many of you have expressed interest in my Security Log Secrets in-person training if I ever scheduled a seminar at a public venue and date I m thinking about doing just that November or December of this year Choosing the right date and venue makes all the difference in getting enough attendees in order to run the course If you would like to attend such a course, would you please respond to my survey by clicking here If there is enough interest I will schedule the training and announce the venue and pricing next week Here are the relevant links To learn more about my Security Log Secrets training, click here To help me plan the training event, respond to the survey here Thanks and I hope to meet you in person you later this year http://www.secuobs.com/revue/news/141170.shtmlhttp://www.secuobs.com/revue/news/141170.shtml Secuobs.com : 2009-09-11 14:21:01 - Security et al - Just a quick note about the new audit security log features in Windows 7 and Windows Server 2008 R2 1 You can finally configure audit subcategories via group policy No more need for running auditpol scripts on thousands of computers 2 Global audit policies for files and other objects This allows you to configure system wide audit policies for different file types The global policies are supposed to help you ensure all desired objects are audited without having to find and configure auditing at each location where such objects exist 3 Object access events now provide more information as to why access was allowed or denied by reporting the particular access control entries that played a part More to come on these new features in an upcoming webinar Subscribe to my newsletter in order to be notified http://www.secuobs.com/revue/news/140037.shtmlhttp://www.secuobs.com/revue/news/140037.shtml Secuobs.com : 2009-08-29 01:21:43 - Security et al - A while back I did a free training webinar on SQL Injection attacks Applicure sponsored the webinar demonstrated their dotDefender product I am aware that the vendors I invite to sponsor my training events are a reflection on me and may be interpreted by some as an implicit recommendation This is to notify you that I withdraw any recommendation, implied or otherwise, about Applicure and their products http://www.secuobs.com/revue/news/135762.shtmlhttp://www.secuobs.com/revue/news/135762.shtml Secuobs.com : 2009-07-27 20:24:30 - Security et al - Here are links to my recent whitepaper and webinar commissioned by Quest Software You really do need a reporting solution for Active Directory and this whitepaper and webinar will help you justify the investment Whitepaper Webinar http://www.secuobs.com/revue/news/125442.shtmlhttp://www.secuobs.com/revue/news/125442.shtml